apache chainsaw vulnerabilities and exploits

(subscribe to this query)

** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested) hashmap or hashtable (depending on which logging component...

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBi...

1 Article

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows malicious users to manipulate the SQL by ent...

1 Github repository1 Article

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

Apache Chainsaw Apache Log4j Qos Reload4j Oracle Weblogic Server 12.2.1.3.0 Oracle Business Intelligence 12.2.1.3.0 Oracle Business Process Management Suite 12.2.1.3.0 Oracle Jdeveloper 12.2.1.3.0 Oracle Identity Management Suite 12.2.1.3.0 Oracle Business Intelligence 12.2.1.4.0 Oracle Weblogic Server 12.2.1.4.0 Oracle Weblogic Server 14.1.1.0.0 Oracle Enterprise Manager Base Platform 13.4.0.0 Oracle Communications Network Integrity 7.3.6 Oracle Business Process Management Suite 12.2.1.4.0 Oracle Advanced Supply Chain Planning 12.2 Oracle Advanced Supply Chain Planning 12.1 Oracle Communications Unified Inventory Management 7.4.1 Oracle Enterprise Manager Base Platform 13.5.0.0 Oracle Communications Messaging Server 8.1 Oracle Business Intelligence 5.9.0.0.0 Oracle Healthcare Foundation 8.1.0 Oracle Communications Eagle Ftp Table Base Retrieval 4.5

1 Github repository1 Article

A deserialization flaw was found in Apache Chainsaw versions before 2.1.0 which could lead to malicious code execution.

Apache Chainsaw Apache Log4j Qos Reload4j

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook