drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Ausführen beliebiger Kommandos in Log4j
Name: |
Ausführen beliebiger Kommandos in Log4j |
|
ID: |
RHSA-2022:1463-01 |
|
Distribution: |
Red Hat |
|
Plattformen: |
Red Hat Single Sign-On |
|
Datum: |
Do, 21. April 2022, 07:14 |
|
Referenzen: |
https://access.redhat.com/security/cve/CVE-2021-45105
https://access.redhat.com/articles/11258 |
|
Applikationen: |
Log4j |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
===================================================================== Red Hat Security Advisory
Synopsis: Low: Red Hat Single Sign-On 7.5.2 security update on RHEL 8 Advisory ID: RHSA-2022:1463-01 Product: Red Hat Single Sign-On Advisory URL: https://access.redhat.com/errata/RHSA-2022:1463 Issue date: 2022-04-20 CVE Names: CVE-2021-45105 =====================================================================
1. Summary:
New Red Hat Single Sign-On 7.5.2 packages are now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Single Sign-On 7.4 for RHEL 8 - noarch
3. Description:
Red Hat Single Sign-On 7.5 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.
This release of Red Hat Single Sign-On 7.5.2 on RHEL 8 serves as a replacement for Red Hat Single Sign-On 7.5.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
* log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern (CVE-2021-45105)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
4. Solution:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
2034067 - CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern
6. Package List:
Red Hat Single Sign-On 7.4 for RHEL 8:
Source: rh-sso7-keycloak-15.0.6-1.redhat_00001.1.el8sso.src.rpm
noarch: rh-sso7-keycloak-15.0.6-1.redhat_00001.1.el8sso.noarch.rpm rh-sso7-keycloak-server-15.0.6-1.redhat_00001.1.el8sso.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2021-45105 https://access.redhat.com/security/updates/classification/#low https://access.redhat.com/articles/11258
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBYmAyEtzjgjWX9erEAQi/vg//SPdpN9hqy1FB2VKKYuPtx1ufIRnCEuZo i+K0ksrdNfqIGtl7xHZdXi7u9zNj6ek/HeNnQfs9AXdoiE8LO/ZaPcF7whrH0Riy q6XFchuLlM8eWbX9T2BEfi7v+OJhlO0vCDvQEy87rSpw+DtEi3hsMtZpSTQXOGcC JPzxjwxI67a+st31/QJGt47J9WR0YfgyKmg4WyaDfPbLvbMhQgGdhR5iN4OryC5n v+FIbavSrWdk7B2mXmA1KFwFL+fvj98p+NE6F2+KU5oX1kf/HDpXlNshyLgzNCEf Q2OLQ/Cttr3cC/ygAoFtZw2495IdpkHEY8SvLI25IU9ejfkzakBPRUIn8ne39Nl3 MiqCnM/4r3CPjVdqLqTZjRNcgIkXXgtlQ/Rm8brsmjQfRmkA8Ov7RstsYoaiqjjb jaN4WVvTEvTrlYC/eoC2XQ90ZlkSNw+yvDX7b9W9f70eYquNVbizMvIQu8Th1J0G sEvH3zAEBbtw0ya++v6MZ+O8Bzlg6yNR6gtUWflGQxAkK0m4ltuEBdhfApMmHpef NKkCi2B7V3wjGvUHZJVLPskHfALUH14uJduKDzGylQKELoJoFUfPktSqjWeol/Rx PwbXqd5BPwyTGRmvl5+gB75Cd5rOuIJywdeWtvcOEmcZ4jxC0Nf6TaJdO/00iEnK qIDzHb9XCzE= =HvoO -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce
|
|
|
|