--- type: "firecrawl-provider" description: "Red Hat Product Security's CVE and errata data from the Red Hat Security Data API (access.redhat.com/hydra/rest/securitydata): look up a CVE as Red Hat tracks it, search Red Hat CVEs by package, product, severity, CWE, CVSS v3 score, erratum, Bugzilla id or public date, and look up an RHSA/RHBA/RHEA erratum with its CVEs, product streams and fixed packages (CSAF 2.0). Red Hat's vendor view, which neither NVD nor OSV carries: Red Hat's own threat severity and CVSS score (often lower or higher than NVD's), per-product fix state across RHEL, OpenShift and other Red Hat products (Affected, Not affected, Will not fix, Fix deferred), the RHSA errata that fix each product, and Red Hat's statement and mitigation. Every result carries Red Hat's CC BY 4.0 attribution." use_when: "Red Hat Product Security's CVE and errata data from the Red Hat Security Data API (access.redhat.com/hydra/rest/securitydata): look up a CVE as Red Hat tracks it, search Red Hat CVEs by package, product, severity, CWE, CVSS v3 score, erratum, Bugzilla id or public date, and look up an RHSA/RHBA/RHEA erratum with its CVEs, product streams and fixed packages (CSAF 2.0). Red Hat's vendor view, which neither NVD nor OSV carries: Red Hat's own threat severity and CVSS score (often lower or higher than NVD's), per-product fix state across RHEL, OpenShift and other Red Hat products (Affected, Not affected, Will not fix, Fix deferred), the RHSA errata that fix each product, and Red Hat's statement and mitigation. Every result carries Red Hat's CC BY 4.0 attribution." categories: "Developer" capabilities: 3 credits_per_call: 5 --- # Red Hat Security Data API on Firecrawl Alexandria Red Hat Product Security's CVE and errata data from the Red Hat Security Data API (access.redhat.com/hydra/rest/securitydata): look up a CVE as Red Hat tracks it, search Red Hat CVEs by package, product, severity, CWE, CVSS v3 score, erratum, Bugzilla id or public date, and look up an RHSA/RHBA/RHEA erratum with its CVEs, product streams and fixed packages (CSAF 2.0). Red Hat's vendor view, which neither NVD nor OSV carries: Red Hat's own threat severity and CVSS score (often lower or higher than NVD's), per-product fix state across RHEL, OpenShift and other Red Hat products (Affected, Not affected, Will not fix, Fix deferred), the RHSA errata that fix each product, and Red Hat's statement and mitigation. Every result carries Red Hat's CC BY 4.0 attribution. - Categories: Developer - Category index: [Developer category](https://firecrawl.dev/alexandria/agents/categories/developer) - Provider key: `access-redhat-com` - Access: Firecrawl credits - Cost: 5 credits per call ## More - [Human guide](https://firecrawl.dev/app/alexandria/access-redhat-com) - [OpenAPI spec](https://firecrawl.dev/alexandria/agents/providers/access-redhat-com/openapi.json) ## Capabilities - [Advisory](https://firecrawl.dev/alexandria/agents/providers/access-redhat-com/vulnerabilities/advisory): One Red Hat erratum (RHSA security advisory, RHBA or RHEA) by id or access.redhat.com/errata URL, from its CSAF 2.0 document: title, aggregate severity, release and revision dates, Topic and Details notes, every CVE it fixes with Red Hat impact, CVSS v3, CWE and Bugzilla ids, the product streams it updates (with CPE) and every fixed package or container image per product with its purl. Errata whose CSAF document exceeds 1 MiB (large kernel or OpenShift errata) return a summary: CVEs, severity, release date and fixed package NEVRAs. Carries Red Hat's CC BY 4.0 attribution. - [Cve](https://firecrawl.dev/alexandria/agents/providers/access-redhat-com/vulnerabilities/cve): One CVE as Red Hat Product Security tracks it, by CVE id or access.redhat.com/security/cve URL: Red Hat threat severity, Red Hat CVSS v3 and v2 scores and vectors, CWE, public date, Bugzilla tracker, flaw details, Red Hat's statement and mitigation, references, every product release that shipped a fix (product, package, RHSA erratum, release date) and the fix state of every other product (Affected, Not affected, Will not fix, Fix deferred, Out of support scope). Carries Red Hat's CC BY 4.0 attribution. - [Search](https://firecrawl.dev/alexandria/agents/providers/access-redhat-com/vulnerabilities/search): Search Red Hat Product Security's CVE list: filter by package name, Red Hat product name, Red Hat threat severity, CWE, minimum Red Hat CVSS v3 score, fixing erratum, Bugzilla id, explicit CVE ids or public date range. Each row has Red Hat severity, CVSS v3/v2 score and vector, CWE, public date, Bugzilla title, fixing errata and fixed package NEVRAs. Newest first, paged with a cursor. Carries Red Hat's CC BY 4.0 attribution. ## 1. Choose this provider when Red Hat Product Security's CVE and errata data from the Red Hat Security Data API (access.redhat.com/hydra/rest/securitydata): look up a CVE as Red Hat tracks it, search Red Hat CVEs by package, product, severity, CWE, CVSS v3 score, erratum, Bugzilla id or public date, and look up an RHSA/RHBA/RHEA erratum with its CVEs, product streams and fixed packages (CSAF 2.0). Red Hat's vendor view, which neither NVD nor OSV carries: Red Hat's own threat severity and CVSS score (often lower or higher than NVD's), per-product fix state across RHEL, OpenShift and other Red Hat products (Affected, Not affected, Will not fix, Fix deferred), the RHSA errata that fix each product, and Red Hat's statement and mitigation. Every result carries Red Hat's CC BY 4.0 attribution. ## 2. Minimal request Call `POST https://api.firecrawl.dev/v2/scrape` with `{ alexandria: { provider, capability, options } }`. For a batch, send `{ alexandria: [...] }` with up to 10 calls. ```json { "provider": "access-redhat-com", "capability": "vulnerabilities/advisory", "options": { "advisory_id": "RHSA-2021:5137" } } ``` ## 3. Add provider options Use only the options needed for the task: - `advisory_id` (string): Erratum id, e.g. RHSA-2022:0001. Give advisory_id or url. Pattern: ^\s*[Rr][Hh][SsBbEe][Aa]-[0-9]{4}(:|%3[Aa])[0-9]{4,9}\s*$. Example: `` - `url` (string): An https://access.redhat.com/errata/RHSA-... page URL. Mutually exclusive with advisory_id. Pattern: ^https?://. Example: `` ## 4. Request through your preferred interface ### JavaScript ```javascript const result = await firecrawl.scrape({ alexandria: { provider: "access-redhat-com", capability: "vulnerabilities/advisory", options: { advisory_id: "RHSA-2021:5137", }, }, }); ``` ### Python ```python result = firecrawl.scrape_alexandria({ "provider": "access-redhat-com", "capability": "vulnerabilities/advisory", "options": { "advisory_id": "RHSA-2021:5137" } }) ``` ### cURL ```sh curl https://api.firecrawl.dev/v2/scrape \ -H "Authorization: Bearer $FIRECRAWL_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "alexandria": { "provider": "access-redhat-com", "capability": "vulnerabilities/advisory", "options": { "advisory_id": "RHSA-2021:5137" } } }' ``` ### CLI ```sh firecrawl scrape 'access-redhat-com/vulnerabilities/advisory' \ --options '{"advisory_id":"RHSA-2021:5137"}' ``` ### MCP Call the FCX MCP retrieve tool with this object: ```json { "provider": "access-redhat-com", "capability": "vulnerabilities/advisory", "options": { "advisory_id": "RHSA-2021:5137" } } ``` Ask for only the returned fields needed by the task. ## 5. Full request shape ```json { "provider": "access-redhat-com", "capability": "vulnerabilities/advisory", "options": { "advisory_id": "RHSA-2021:5137" } } ``` ## 6. Response data The response includes `success`, `provider`, `capability`, `creditsCost` and `data`. This example shows the provider payload in `data`: ```json { "advisory": { "advisory_id": "RHSA-2021:5137", "bugzilla_ids": [ "2030932", "2032580" ], "current_release_date": "2026-10-12T14:10:00+00:00", "cve_count": 2, "cves": [ { "bugzilla_ids": [ "2030932" ], "cve_id": "CVE-2021-44228", "cvss3_score": 9.8, "cvss3_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cwe_id": "CWE-20", "cwe_name": "Improper Input Validation", "discovery_date": "2021-12-10T00:00:00+00:00", "release_date": "2021-12-10T02:01:00+00:00", "threat_severity": "Moderate", "title": "log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value" }, { "bugzilla_ids": [ "2032580" ], "cve_id": "CVE-2021-45046", "cvss3_score": 8.1, "cvss3_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cwe_id": "CWE-917", "cwe_name": "Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')", "discovery_date": "2021-12-14T00:00:00+00:00", "release_date": "2021-12-14T00:00:00+00:00", "threat_severity": "Moderate", "title": "log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)" } ], "details": "Openshift Logging Bug Fix Release (5.0.10)\n\nSecurity Fix(es):\n\n* log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value (CVE-2021-44228)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "errata_url": "https://access.redhat.com/errata/RHSA-2021:5137", "fixed_package_count": 3, "fixed_packages": [ { "package": "openshift-logging/elasticsearch6-rhel8@sha256:8612f54b6b077febf9ab833b6bf6fe4673bc29ed8765323e60c4b7531ef40407_s390x", "product": "OpenShift Logging 5.0", "purl": "pkg:oci/elasticsearch6-rhel8@sha256:8612f54b6b077febf9ab833b6bf6fe4673bc29ed8765323e60c4b7531ef40407?arch=s390x&repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8&tag=v5.0.10-1" }, { "package": "openshift-logging/elasticsearch6-rhel8@sha256:a70f88abff582e94a56f650acb782217e6247dc13343d7803492467a4881a9b0_ppc64le", "product": "OpenShift Logging 5.0", "purl": "pkg:oci/elasticsearch6-rhel8@sha256:a70f88abff582e94a56f650acb782217e6247dc13343d7803492467a4881a9b0?arch=ppc64le&repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8&tag=v5.0.10-1" }, { "package": "openshift-logging/elasticsearch6-rhel8@sha256:c4fb65aaf2602f06b713da8e5b5674d880f57177510a533135cbb93c7e362eb9_amd64", "product": "OpenShift Logging 5.0", "purl": "pkg:oci/elasticsearch6-rhel8@sha256:c4fb65aaf2602f06b713da8e5b5674d880f57177510a533135cbb93c7e362eb9?arch=amd64&repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8&tag=v5.0.10-1" } ], "initial_release_date": "2021-12-14T21:36:36+00:00", "products": [ { "cpe": "cpe:/a:redhat:logging:5.0::el8", "name": "OpenShift Logging 5.0", "product_id": "8Base-OSE-LOGGING-5.0" } ], "severity": "Moderate", "title": "Red Hat Security Advisory: Openshift Logging Security Release (5.0.10)", "topic": "Openshift Logging Security Release (5.0.10)\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "type": "security" }, "detail": "full", "notice": "Contains Red Hat Security Data (https://access.redhat.com/security/data), copyright Red Hat, Inc., licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Restructured by Firecrawl.", "observed_at_ms": 1792789796989, "source_url": "https://access.redhat.com/hydra/rest/securitydata/csaf/RHSA-2021:5137.json" } ``` ## API reference-derived contract The following capability contract is generated from the same normalized Alexandria API reference exposed in the API spec. ### Advisory - Capability: `vulnerabilities/advisory` - Description: One Red Hat erratum (RHSA security advisory, RHBA or RHEA) by id or access.redhat.com/errata URL, from its CSAF 2.0 document: title, aggregate severity, release and revision dates, Topic and Details notes, every CVE it fixes with Red Hat impact, CVSS v3, CWE and Bugzilla ids, the product streams it updates (with CPE) and every fixed package or container image per product with its purl. Errata whose CSAF document exceeds 1 MiB (large kernel or OpenShift errata) return a summary: CVEs, severity, release date and fixed package NEVRAs. Carries Red Hat's CC BY 4.0 attribution. - Instructions: You have an RHSA/RHBA/RHEA id or errata URL and need what it fixes: CVEs, affected RHEL or OpenShift product streams, fixed package versions or image digests, and release date. NVD and OSV list RHSA ids only as references, without Red Hat's per-product package fixes. - Cost: 5 credits per call - Capability file: [Advisory](https://firecrawl.dev/alexandria/agents/providers/access-redhat-com/vulnerabilities/advisory) Accepted options: - `advisory_id` (string): Erratum id, e.g. RHSA-2022:0001. Give advisory_id or url. Pattern: ^\s*[Rr][Hh][SsBbEe][Aa]-[0-9]{4}(:|%3[Aa])[0-9]{4,9}\s*$. Example: `` - `url` (string): An https://access.redhat.com/errata/RHSA-... page URL. Mutually exclusive with advisory_id. Pattern: ^https?://. Example: `` Response schema example: ```json { "advisory": { "advisory_id": "RHSA-2021:5137", "bugzilla_ids": [ "2030932", "2032580" ], "current_release_date": "2026-10-12T14:10:00+00:00", "cve_count": 2, "cves": [ { "bugzilla_ids": [ "2030932" ], "cve_id": "CVE-2021-44228", "cvss3_score": 9.8, "cvss3_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cwe_id": "CWE-20", "cwe_name": "Improper Input Validation", "discovery_date": "2021-12-10T00:00:00+00:00", "release_date": "2021-12-10T02:01:00+00:00", "threat_severity": "Moderate", "title": "log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value" }, { "bugzilla_ids": [ "2032580" ], "cve_id": "CVE-2021-45046", "cvss3_score": 8.1, "cvss3_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cwe_id": "CWE-917", "cwe_name": "Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')", "discovery_date": "2021-12-14T00:00:00+00:00", "release_date": "2021-12-14T00:00:00+00:00", "threat_severity": "Moderate", "title": "log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)" } ], "details": "Openshift Logging Bug Fix Release (5.0.10)\n\nSecurity Fix(es):\n\n* log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value (CVE-2021-44228)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "errata_url": "https://access.redhat.com/errata/RHSA-2021:5137", "fixed_package_count": 3, "fixed_packages": [ { "package": "openshift-logging/elasticsearch6-rhel8@sha256:8612f54b6b077febf9ab833b6bf6fe4673bc29ed8765323e60c4b7531ef40407_s390x", "product": "OpenShift Logging 5.0", "purl": "pkg:oci/elasticsearch6-rhel8@sha256:8612f54b6b077febf9ab833b6bf6fe4673bc29ed8765323e60c4b7531ef40407?arch=s390x&repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8&tag=v5.0.10-1" }, { "package": "openshift-logging/elasticsearch6-rhel8@sha256:a70f88abff582e94a56f650acb782217e6247dc13343d7803492467a4881a9b0_ppc64le", "product": "OpenShift Logging 5.0", "purl": "pkg:oci/elasticsearch6-rhel8@sha256:a70f88abff582e94a56f650acb782217e6247dc13343d7803492467a4881a9b0?arch=ppc64le&repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8&tag=v5.0.10-1" }, { "package": "openshift-logging/elasticsearch6-rhel8@sha256:c4fb65aaf2602f06b713da8e5b5674d880f57177510a533135cbb93c7e362eb9_amd64", "product": "OpenShift Logging 5.0", "purl": "pkg:oci/elasticsearch6-rhel8@sha256:c4fb65aaf2602f06b713da8e5b5674d880f57177510a533135cbb93c7e362eb9?arch=amd64&repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8&tag=v5.0.10-1" } ], "initial_release_date": "2021-12-14T21:36:36+00:00", "products": [ { "cpe": "cpe:/a:redhat:logging:5.0::el8", "name": "OpenShift Logging 5.0", "product_id": "8Base-OSE-LOGGING-5.0" } ], "severity": "Moderate", "title": "Red Hat Security Advisory: Openshift Logging Security Release (5.0.10)", "topic": "Openshift Logging Security Release (5.0.10)\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "type": "security" }, "detail": "full", "notice": "Contains Red Hat Security Data (https://access.redhat.com/security/data), copyright Red Hat, Inc., licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Restructured by Firecrawl.", "observed_at_ms": 1792789796989, "source_url": "https://access.redhat.com/hydra/rest/securitydata/csaf/RHSA-2021:5137.json" } ``` ### Cve - Capability: `vulnerabilities/cve` - Description: One CVE as Red Hat Product Security tracks it, by CVE id or access.redhat.com/security/cve URL: Red Hat threat severity, Red Hat CVSS v3 and v2 scores and vectors, CWE, public date, Bugzilla tracker, flaw details, Red Hat's statement and mitigation, references, every product release that shipped a fix (product, package, RHSA erratum, release date) and the fix state of every other product (Affected, Not affected, Will not fix, Fix deferred, Out of support scope). Carries Red Hat's CC BY 4.0 attribution. - Instructions: You have a CVE id and need Red Hat's answer: is a RHEL, OpenShift or other Red Hat product affected, which RHSA fixes it, or what severity and score Red Hat gives it. Use nvd-nist-gov for NVD's CPE matches and CISA KEV, and osv-dev for upstream package version ranges; neither has Red Hat's per-product fix state. - Cost: 5 credits per call - Capability file: [Cve](https://firecrawl.dev/alexandria/agents/providers/access-redhat-com/vulnerabilities/cve) Accepted options: - `cve_id` (string): CVE id, e.g. CVE-2021-44228 (case-insensitive). Give cve_id or url. Pattern: ^\s*[Cc][Vv][Ee]-[0-9]{4}-[0-9]{4,19}\s*$. Example: `` - `url` (string): An https://access.redhat.com/security/cve/CVE-... page URL. Mutually exclusive with cve_id. Pattern: ^https?://. Example: `` Response schema example: ```json { "cve": { "acknowledgement": null, "advisories": [ "RHSA-2021:5137", "RHSA-2021:5128", "RHSA-2021:5127", "RHSA-2021:5129", "RHSA-2021:5133", "RHSA-2021:5138", "RHSA-2021:5132", "RHSA-2021:5134", "RHSA-2022:0203", "RHSA-2021:5130", "RHSA-2021:5126", "RHSA-2021:5140", "RHSA-2025:1746", "RHSA-2025:1747", "RHSA-2021:5094", "RHSA-2021:5106", "RHSA-2021:5141", "RHSA-2021:5107", "RHSA-2021:5108", "RHSA-2021:5148", "RHSA-2022:0082", "RHSA-2022:0296", "RHSA-2021:5093" ], "affected_packages": null, "affected_release": [ { "advisory": "RHSA-2021:5137", "cpe": "cpe:/a:redhat:logging:5.0::el8", "impact": "moderate", "package": "openshift-logging/elasticsearch6-rhel8:v5.0.10-1", "product_name": "OpenShift Logging 5.0", "release_date": "2021-12-14T00:00:00Z" }, { "advisory": "RHSA-2021:5128", "cpe": "cpe:/a:redhat:logging:5.1::el8", "impact": "moderate", "package": "openshift-logging/elasticsearch6-rhel8:v6.8.1-67", "product_name": "OpenShift Logging 5.1", "release_date": "2021-12-14T00:00:00Z" }, { "advisory": "RHSA-2021:5127", "cpe": "cpe:/a:redhat:logging:5.2::el8", "impact": "moderate", "package": "openshift-logging/elasticsearch6-rhel8:v6.8.1-66", "product_name": "OpenShift Logging 5.2", "release_date": "2021-12-14T00:00:00Z" }, { "advisory": "RHSA-2021:5129", "cpe": "cpe:/a:redhat:logging:5.3::el8", "impact": "moderate", "package": "openshift-logging/elasticsearch6-rhel8:v6.8.1-65", "product_name": "OpenShift Logging 5.3", "release_date": "2021-12-14T00:00:00Z" }, { "advisory": "RHSA-2021:5133", "cpe": "cpe:/a:redhat:amq_streams:1", "impact": null, "package": null, "product_name": "Red Hat AMQ Streams 1.6.5", "release_date": "2021-12-14T00:00:00Z" }, { "advisory": "RHSA-2021:5138", "cpe": "cpe:/a:redhat:amq_streams:1", "impact": null, "package": "log4j-core", "product_name": "Red Hat AMQ Streams 1.8.4", "release_date": "2021-12-14T00:00:00Z" }, { "advisory": "RHSA-2021:5132", "cpe": "cpe:/a:redhat:jboss_data_grid:8.2", "impact": null, "package": "log4j-core", "product_name": "Red Hat Data Grid 8.2.2", "release_date": "2021-12-14T00:00:00Z" }, { "advisory": "RHSA-2021:5134", "cpe": "cpe:/a:redhat:jboss_fuse:7", "impact": null, "package": "log4j-core", "product_name": "Red Hat Fuse 7.10", "release_date": "2021-12-14T00:00:00Z" }, { "advisory": "RHSA-2022:0203", "cpe": "cpe:/a:redhat:jboss_fuse:7", "impact": null, "package": "log4j-core", "product_name": "Red Hat Fuse 7.8.2, 7.9.1, 7.10.1", "release_date": "2022-01-20T00:00:00Z" }, { "advisory": "RHSA-2021:5130", "cpe": "cpe:/a:redhat:integration:1", "impact": null, "package": "log4j-core", "product_name": "Red Hat Integration", "release_date": "2021-12-14T00:00:00Z" }, { "advisory": "RHSA-2021:5126", "cpe": "cpe:/a:redhat:camel_quarkus:2.2", "impact": null, "package": null, "product_name": "Red Hat Integration Camel Quarkus 2", "release_date": "2021-12-14T00:00:00Z" }, { "advisory": "RHSA-2021:5140", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform::el7", "impact": null, "package": "org.apache.logging.log4j/log4j-api:2.17.1.redhat-00002", "product_name": "Red Hat JBoss Enterprise Application Platform", "release_date": "2021-12-15T00:00:00Z" }, { "advisory": "RHSA-2025:1746", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7", "impact": null, "package": "eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7", "release_date": "2025-02-24T00:00:00Z" }, { "advisory": "RHSA-2025:1746", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7", "impact": null, "package": "eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7", "release_date": "2025-02-24T00:00:00Z" }, { "advisory": "RHSA-2025:1746", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7", "impact": null, "package": "eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7", "release_date": "2025-02-24T00:00:00Z" }, { "advisory": "RHSA-2025:1746", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7", "impact": null, "package": "eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7", "release_date": "2025-02-24T00:00:00Z" }, { "advisory": "RHSA-2025:1746", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7", "impact": null, "package": "eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7", "release_date": "2025-02-24T00:00:00Z" }, { "advisory": "RHSA-2025:1746", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7", "impact": null, "package": "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7", "release_date": "2025-02-24T00:00:00Z" }, { "advisory": "RHSA-2025:1746", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7", "impact": null, "package": "eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7", "release_date": "2025-02-24T00:00:00Z" }, { "advisory": "RHSA-2025:1746", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7", "impact": null, "package": "eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7", "release_date": "2025-02-24T00:00:00Z" }, { "advisory": "RHSA-2025:1747", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7", "impact": null, "package": "eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap", "product_name": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "release_date": "2025-02-24T00:00:00Z" }, { "advisory": "RHSA-2025:1747", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7", "impact": null, "package": "eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap", "product_name": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "release_date": "2025-02-24T00:00:00Z" }, { "advisory": "RHSA-2025:1747", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7", "impact": null, "package": "eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap", "product_name": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "release_date": "2025-02-24T00:00:00Z" }, { "advisory": "RHSA-2025:1747", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7", "impact": null, "package": "eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap", "product_name": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "release_date": "2025-02-24T00:00:00Z" }, { "advisory": "RHSA-2025:1747", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7", "impact": null, "package": "eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap", "product_name": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "release_date": "2025-02-24T00:00:00Z" }, { "advisory": "RHSA-2025:1747", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7", "impact": null, "package": "eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap", "product_name": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "release_date": "2025-02-24T00:00:00Z" }, { "advisory": "RHSA-2025:1747", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7", "impact": null, "package": "eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap", "product_name": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "release_date": "2025-02-24T00:00:00Z" }, { "advisory": "RHSA-2025:1747", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7", "impact": null, "package": "eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap", "product_name": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "release_date": "2025-02-24T00:00:00Z" }, { "advisory": "RHSA-2025:1747", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7", "impact": null, "package": "eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap", "product_name": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "release_date": "2025-02-24T00:00:00Z" }, { "advisory": "RHSA-2025:1747", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7", "impact": null, "package": "eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap", "product_name": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "release_date": "2025-02-24T00:00:00Z" }, { "advisory": "RHSA-2025:1747", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7", "impact": null, "package": "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap", "product_name": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "release_date": "2025-02-24T00:00:00Z" }, { "advisory": "RHSA-2025:1747", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7", "impact": null, "package": "eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap", "product_name": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "release_date": "2025-02-24T00:00:00Z" }, { "advisory": "RHSA-2021:5094", "cpe": "cpe:/a:redhat:openshift:3.11::el7", "impact": "moderate", "package": "openshift3/ose-logging-elasticsearch5:v3.11.570-2.gd119820", "product_name": "Red Hat OpenShift Container Platform 3.11", "release_date": "2021-12-14T00:00:00Z" }, { "advisory": "RHSA-2021:5106", "cpe": "cpe:/a:redhat:openshift:4.6::el8", "impact": "moderate", "package": "openshift4/ose-logging-elasticsearch6:v4.6.0-202112132021.p0.g2a13a81.assembly.stream", "product_name": "Red Hat OpenShift Container Platform 4.6", "release_date": "2021-12-16T00:00:00Z" }, { "advisory": "RHSA-2021:5106", "cpe": "cpe:/a:redhat:openshift:4.6::el8", "impact": "moderate", "package": "openshift4/ose-metering-hive:v4.6.0-202112140546.p0.g8b9da97.assembly.stream", "product_name": "Red Hat OpenShift Container Platform 4.6", "release_date": "2021-12-16T00:00:00Z" }, { "advisory": "RHSA-2021:5141", "cpe": "cpe:/a:redhat:openshift:4.6::el8", "impact": null, "package": "openshift4/ose-metering-presto:v4.6.0-202112150545.p0.g190688a.assembly.art3595", "product_name": "Red Hat OpenShift Container Platform 4.6", "release_date": "2021-12-16T00:00:00Z" }, { "advisory": "RHSA-2021:5107", "cpe": "cpe:/a:redhat:openshift:4.7::el8", "impact": null, "package": "openshift4/ose-metering-hive:v4.7.0-202112140553.p0.g091bb99.assembly.stream", "product_name": "Red Hat OpenShift Container Platform 4.7", "release_date": "2021-12-16T00:00:00Z" }, { "advisory": "RHSA-2021:5107", "cpe": "cpe:/a:redhat:openshift:4.7::el8", "impact": null, "package": "openshift4/ose-metering-presto:v4.7.0-202112150631.p0.gd502108.assembly.4.7.40", "product_name": "Red Hat OpenShift Container Platform 4.7", "release_date": "2021-12-16T00:00:00Z" }, { "advisory": "RHSA-2021:5108", "cpe": "cpe:/a:redhat:openshift:4.8::el8", "impact": null, "package": "openshift4/ose-metering-hive:v4.8.0-202112132154.p0.g57dd03a.assembly.stream", "product_name": "Red Hat OpenShift Container Platform 4.8", "release_date": "2021-12-14T00:00:00Z" }, { "advisory": "RHSA-2021:5148", "cpe": "cpe:/a:redhat:openshift:4.8::el8", "impact": null, "package": "openshift4/ose-metering-presto:v4.8.0-202112150431.p0.g4b934ae.assembly.art3599", "product_name": "Red Hat OpenShift Container Platform 4.8", "release_date": "2021-12-15T00:00:00Z" }, { "advisory": "RHSA-2022:0082", "cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7.11", "impact": null, "package": null, "product_name": "RHPAM 7.11.1", "release_date": "2022-01-11T00:00:00Z" }, { "advisory": "RHSA-2022:0296", "cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7.12", "impact": "low", "package": "log4j-core", "product_name": "RHPAM 7.12.0", "release_date": "2022-01-26T00:00:00Z" }, { "advisory": "RHSA-2021:5093", "cpe": "cpe:/a:redhat:openshift_application_runtimes:1.0", "impact": null, "package": "log4j-core", "product_name": "Vert.x 4.1.5 SP1", "release_date": "2021-12-14T00:00:00Z" } ], "affected_release_count": 43, "bugzilla": { "description": "log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value", "id": "2030932", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2030932" }, "csaw": true, "cve_id": "CVE-2021-44228", "cvss2": null, "cvss3": { "base_score": 9.8, "status": "verified", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "cwe": "CWE-20", "details": [ "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.", "A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.15.0. A remote attacker who can control log messages or log message parameters, can execute arbitrary code on the server via JNDI LDAP endpoint." ], "mitigation": "For Log4j versions >=2.10\nset the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true\nFor Log4j versions >=2.7 and <=2.14.1\nall PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m\nFor Log4j versions >=2.0-beta9 and <=2.10.0\nremove the JndiLookup class from the classpath. For example: \n```\nzip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class\n```\nOn OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421\nOn OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441", "package_state": [ { "cpe": "cpe:/a:redhat:a_mq_clients:2", "fix_state": "Not affected", "impact": null, "package_name": "log4j-core", "product_name": "A-MQ Clients 2" }, { "cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Not affected", "impact": null, "package_name": "log4j", "product_name": "Red Hat 3scale API Management Platform 2" }, { "cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Not affected", "impact": null, "package_name": "log4j", "product_name": "Red Hat AMQ Broker 7" }, { "cpe": "cpe:/a:redhat:quarkus:2", "fix_state": "Not affected", "impact": null, "package_name": "log4j-core", "product_name": "Red Hat build of Quarkus" }, { "cpe": "cpe:/a:redhat:jboss_enterprise_brms_platform:7", "fix_state": "Not affected", "impact": null, "package_name": "log4j-core", "product_name": "Red Hat Decision Manager 7" }, { "cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "impact": null, "package_name": "log4j", "product_name": "Red Hat Enterprise Linux 6" }, { "cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "impact": null, "package_name": "log4j", "product_name": "Red Hat Enterprise Linux 7" }, { "cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "impact": null, "package_name": "parfait:0.5/log4j12", "product_name": "Red Hat Enterprise Linux 8" }, { "cpe": "cpe:/a:redhat:camel_quarkus:2", "fix_state": "Affected", "impact": null, "package_name": "log4j-core", "product_name": "Red Hat Integration Camel Quarkus 1" }, { "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6", "fix_state": "Not affected", "impact": null, "package_name": "log4j", "product_name": "Red Hat JBoss Enterprise Application Platform 6" }, { "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Affected", "impact": "low", "package_name": "log4j-core", "product_name": "Red Hat JBoss Enterprise Application Platform 7" }, { "cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Not affected", "impact": null, "package_name": "log4j-core", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack" }, { "cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Out of support scope", "impact": null, "package_name": "opendaylight", "product_name": "Red Hat OpenStack Platform 13 (Queens)" }, { "cpe": "cpe:/a:redhat:quay:3", "fix_state": "Not affected", "impact": null, "package_name": "quay/quay-rhel8", "product_name": "Red Hat Quay 3" }, { "cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "impact": null, "package_name": "log4j-over-slf4j", "product_name": "Red Hat Satellite 6" }, { "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Not affected", "impact": null, "package_name": "log4j-core", "product_name": "Red Hat Single Sign-On 7" }, { "cpe": "cpe:/a:redhat:rhel_software_collections:3", "fix_state": "Not affected", "impact": null, "package_name": "rh-java-common-log4j", "product_name": "Red Hat Software Collections" }, { "cpe": "cpe:/a:redhat:rhel_software_collections:3", "fix_state": "Not affected", "impact": null, "package_name": "rh-maven35-log4j12", "product_name": "Red Hat Software Collections" }, { "cpe": "cpe:/a:redhat:rhel_software_collections:3", "fix_state": "Not affected", "impact": null, "package_name": "rh-maven36-log4j12", "product_name": "Red Hat Software Collections" }, { "cpe": "cpe:/a:redhat:stf:1.3::el8", "fix_state": "Not affected", "impact": null, "package_name": "stf/sg-core-rhel8", "product_name": "Service Telemetry Framework 1.3 for RHEL 8" } ], "package_state_count": 20, "public_date": "2021-12-10T02:01:00Z", "redhat_url": "https://access.redhat.com/security/cve/CVE-2021-44228", "references": [ "https://www.cve.org/CVERecord?id=CVE-2021-44228", "https://nvd.nist.gov/vuln/detail/CVE-2021-44228", "https://github.com/advisories/GHSA-jfh8-c2jp-5v3q", "https://logging.apache.org/log4j/2.x/security.html", "https://www.lunasec.io/docs/blog/log4j-zero-day/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "statement": "This issue only affects log4j versions between 2.0 and 2.14.1. In order to exploit this flaw you need:\n- A remotely accessible endpoint with any protocol (HTTP, TCP, etc) that allows an attacker to send arbitrary data,\n- A log statement in the endpoint that logs the attacker controlled data.\nIn Red Hat OpenShift Logging the vulnerable log4j library is shipped in the Elasticsearch components. Because Elasticsearch is not susceptible to remote code execution with this vulnerability due to use of the Java Security Manager and because access to these components is limited, the impact by this vulnerability is reduced to Moderate.\nAs per upstream applications using Log4j 1.x may be impacted by this flaw if their configuration uses JNDI. However, the risk is much lower. This flaw in Log4j 1.x is tracked via https://access.redhat.com/security/cve/CVE-2021-4104 and has been rated as having Moderate security impact.\nCodeReady Studio version 12.21.1 was released containing a fix for this vulnerability.\nThe following products are NOT affected by this flaw and have been explicitly listed here for the benefit of our customers.\n- Red Hat Enterprise Linux\n- Red Hat Advanced Cluster Management for Kubernetes \n- Red Hat Advanced Cluster Security for Kubernetes\n- Red Hat Ansible Automation Platform (Engine and Tower)\n- Red Hat Certificate System\n- Red Hat Directory Server\n- Red Hat Identity Management\n- Red Hat CloudForms \n- Red Hat Update Infrastructure\n- Red Hat Satellite\n- Red Hat Ceph Storage\n- Red Hat Gluster Storage\n- Red Hat OpenShift Data Foundation\n- Red Hat OpenStack Platform\n- Red Hat Virtualization\n- Red Hat Single Sign-On\n- Red Hat 3scale API Management", "threat_severity": "Critical", "upstream_fix": null }, "detail": "full", "notice": "Contains Red Hat Security Data (https://access.redhat.com/security/data), copyright Red Hat, Inc., licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Restructured by Firecrawl.", "observed_at_ms": 1792789796974, "source_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-44228.json" } ``` ### Search - Capability: `vulnerabilities/search` - Description: Search Red Hat Product Security's CVE list: filter by package name, Red Hat product name, Red Hat threat severity, CWE, minimum Red Hat CVSS v3 score, fixing erratum, Bugzilla id, explicit CVE ids or public date range. Each row has Red Hat severity, CVSS v3/v2 score and vector, CWE, public date, Bugzilla title, fixing errata and fixed package NEVRAs. Newest first, paged with a cursor. Carries Red Hat's CC BY 4.0 attribution. - Instructions: You need Red Hat's CVE list for a package, product, severity or date range (e.g. critical openssl CVEs Red Hat published this year, or which CVEs an RHSA covers), or Red Hat severity for up to 50 CVE ids at once. NVD search (nvd-nist-gov) and OSV (osv-dev) do not carry Red Hat severity, errata or fixed NEVRAs. - Cost: 5 credits per call - Capability file: [Search](https://firecrawl.dev/alexandria/agents/providers/access-redhat-com/vulnerabilities/search) Accepted options: - `advisory_id` (string): Only CVEs fixed by this erratum, e.g. RHSA-2021:5137. Pattern: ^\s*[Rr][Hh][SsBbEe][Aa]-[0-9]{4}:[0-9]{4,9}\s*$. Example: `` - `bugzilla_id` (string): Red Hat Bugzilla id. Pattern: ^\s*[0-9]{1,10}\s*$. Example: `` - `cursor` (string): next_cursor from the previous page; keep the other inputs unchanged. Pattern: ^[0-9]{1,5}$. Example: `` - `cve_ids` (string[]): Only these CVE ids (up to 50). Example: `[]` - `cwe` (string): CWE id, e.g. CWE-79 or 79. Pattern: ^\s*([Cc][Ww][Ee]-)?[0-9]{1,6}\s*$. Example: `` - `min_cvss3_score` (number): Only CVEs whose Red Hat CVSS v3 score is at least this. Example: `10` - `package` (string): Package name as Red Hat names it, e.g. openssl, kernel, log4j (matches fixed and affected packages). Example: `` - `page_size` (number): Results per page (default 20). Lower it when a page of heavily packaged CVEs exceeds the 1 MiB read limit. Example: `20` - `product` (string): Red Hat product name, e.g. Red Hat Enterprise Linux 9. Example: `` - `published_after` (string): Public on or after this date, YYYY-MM-DD. Pattern: ^\s*[0-9]{4}-[0-9]{2}-[0-9]{2}\s*$. Example: `` - `published_before` (string): Public before this date, YYYY-MM-DD. Pattern: ^\s*[0-9]{4}-[0-9]{2}-[0-9]{2}\s*$. Example: `` - `severity` (string): Red Hat threat severity. Example: `low` Response schema example: ```json { "next_cursor": null, "notice": "Contains Red Hat Security Data (https://access.redhat.com/security/data), copyright Red Hat, Inc., licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Restructured by Firecrawl.", "observed_at_ms": 1792789796982, "page": 1, "page_size": 20, "result_count": 5, "results": [ { "advisories": [ "RHSA-2022:0227", "RHSA-2022:0205", "RHSA-2022:0216", "RHSA-2022:0226", "RHSA-2022:0138", "RHSA-2022:0225", "RHSA-2022:0467", "RHSA-2022:0203", "RHSA-2022:0236", "RHSA-2022:0223", "RHSA-2022:0222", "RHSA-2022:1299", "RHSA-2022:0485", "RHSA-2022:0230", "RHSA-2022:1297", "RHSA-2022:1296", "RHSA-2022:0493", "RHSA-2022:0083", "RHSA-2022:0181" ], "affected_packages": [ "org.apache.logging.log4j/log4j-api:2.17.1.redhat-00001", "openshift-logging/elasticsearch6-rhel8:v6.8.1-100", "openshift4/ose-metering-hive:v4.8.0-202201271626.p0.g8fb24af.assembly.stream", "openshift4/ose-metering-presto:v4.8.0-202201271626.p0.gf1abc62.assembly.stream", "eap7-log4j-0:2.17.1-1.redhat_00001.1.el7eap", "eap7-log4j-0:2.17.1-1.redhat_00001.1.el8eap", "openshift4/ose-logging-elasticsearch6:v4.6.0-202201181437.p0.g181b827.assembly.stream", "openshift4/ose-metering-presto:v4.7.0-202201271626.p0.g2155d34.assembly.stream", "openshift-logging/elasticsearch6-rhel8:v6.8.1-99", "openshift-logging/elasticsearch6-rhel8:v6.8.1-98", "openshift4/ose-metering-hive:v4.7.0-202201271626.p0.g12e974d.assembly.stream", "openshift3/ose-logging-elasticsearch5:v3.11.570-2.ge84e80c", "openshift-logging/elasticsearch6-rhel8:v5.0.12-1", "log4j-core" ], "bugzilla_description": "log4j-core: remote code execution via JDBC Appender", "bugzilla_id": "2035951", "cve_id": "CVE-2021-44832", "cvss2_score": null, "cvss2_vector": null, "cvss3_score": 6.6, "cvss3_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "cwe": "CWE-20", "public_date": "2021-12-28T00:00:00Z", "redhat_url": "https://access.redhat.com/security/cve/CVE-2021-44832", "severity": "moderate" }, { "advisories": [ "RHSA-2022:0219", "RHSA-2022:0205", "RHSA-2022:0216", "RHSA-2022:1469", "RHSA-2022:0203", "RHSA-2022:0026", "RHSA-2022:0047", "RHSA-2022:0223", "RHSA-2022:0222", "RHSA-2022:1299", "RHSA-2022:0044", "RHSA-2022:1463", "RHSA-2022:0043", "RHSA-2022:1297", "RHSA-2022:1462", "RHSA-2022:0042", "RHSA-2022:1296", "RHSA-2022:0083" ], "affected_packages": [ "org.apache.logging.log4j/log4j-api:2.17.1.redhat-00001", "openshift4/ose-logging-elasticsearch6:v4.6.0-202112201736.p0.gce7f68c.assembly.stream", "openshift-logging/elasticsearch6-rhel8:v6.8.1-84", "openshift-logging/elasticsearch6-rhel8:v6.8.1-83", "eap7-log4j-0:2.17.1-1.redhat_00001.1.el7eap", "rh-sso7-keycloak-0:15.0.6-1.redhat_00001.1.el7sso", "rh-sso7-keycloak-0:15.0.6-1.redhat_00001.1.el8sso", "log4j-api", "openshift-logging/elasticsearch6-rhel8:v5.0.11-2", "openshift-logging/elasticsearch6-rhel8:v6.8.1-82", "log4j-core", "eap7-log4j-0:2.17.1-1.redhat_00001.1.el8eap" ], "bugzilla_description": "log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern", "bugzilla_id": "2034067", "cve_id": "CVE-2021-45105", "cvss2_score": null, "cvss2_vector": null, "cvss3_score": 5.9, "cvss3_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cwe": "CWE-835", "public_date": "2021-12-18T00:00:00Z", "redhat_url": "https://access.redhat.com/security/cve/CVE-2021-45105", "severity": "moderate" }, { "advisories": [ "RHSA-2021:5141", "RHSA-2021:5094", "RHSA-2022:0205", "RHSA-2022:0216", "RHSA-2025:1747", "RHSA-2022:0138", "RHSA-2021:5140", "RHSA-2022:0203", "RHSA-2025:1746", "RHSA-2022:0223", "RHSA-2022:0222", "RHSA-2022:1299", "RHSA-2022:1297", "RHSA-2022:1296", "RHSA-2022:0083", "RHSA-2021:5127", "RHSA-2021:5128", "RHSA-2021:5106", "RHSA-2021:5129", "RHSA-2021:5107", "RHSA-2021:5108", "RHSA-2021:5137", "RHSA-2021:5148" ], "affected_packages": [ "org.apache.logging.log4j/log4j-api:2.17.1.redhat-00001", "eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap", "org.apache.logging.log4j/log4j-api:2.17.1.redhat-00002", "eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap", "eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap", "openshift4/ose-metering-hive:v4.6.0-202112140546.p0.g8b9da97.assembly.stream", "eap7-log4j-0:2.17.1-1.redhat_00001.1.el8eap", "openshift4/ose-metering-presto:v4.7.0-202112150631.p0.gd502108.assembly.4.7.40", "eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap", "openshift-logging/elasticsearch6-rhel8:v6.8.1-66", "openshift-logging/elasticsearch6-rhel8:v6.8.1-65", "openshift-logging/elasticsearch6-rhel8:v6.8.1-67", "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap", "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7", "openshift-logging/elasticsearch6-rhel8:v5.0.10-1", "eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap", "eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7", "eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap", "openshift4/ose-metering-presto:v4.8.0-202112150431.p0.g4b934ae.assembly.art3599", "eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7", "eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7", "eap7-log4j-0:2.17.1-1.redhat_00001.1.el7eap", "eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap", "eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap", "eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7", "eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7", "eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap", "openshift4/ose-metering-hive:v4.7.0-202112140553.p0.g091bb99.assembly.stream", "eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7", "eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap", "openshift4/ose-metering-presto:v4.6.0-202112150545.p0.g190688a.assembly.art3595", "eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap", "openshift3/ose-logging-elasticsearch5:v3.11.570-2.gd119820", "openshift4/ose-metering-hive:v4.8.0-202112132154.p0.g57dd03a.assembly.stream", "openshift4/ose-logging-elasticsearch6:v4.6.0-202112132021.p0.g2a13a81.assembly.stream", "eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7", "log4j-core" ], "bugzilla_description": "log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)", "bugzilla_id": "2032580", "cve_id": "CVE-2021-45046", "cvss2_score": null, "cvss2_vector": null, "cvss3_score": 8.1, "cvss3_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cwe": "CWE-917", "public_date": "2021-12-14T00:00:00Z", "redhat_url": "https://access.redhat.com/security/cve/CVE-2021-45046", "severity": "moderate" }, { "advisories": [ "RHSA-2021:5130", "RHSA-2021:5141", "RHSA-2021:5132", "RHSA-2021:5133", "RHSA-2021:5093", "RHSA-2021:5094", "RHSA-2025:1747", "RHSA-2021:5140", "RHSA-2022:0203", "RHSA-2025:1746", "RHSA-2022:0296", "RHSA-2022:0082", "RHSA-2021:5127", "RHSA-2021:5138", "RHSA-2021:5128", "RHSA-2021:5106", "RHSA-2021:5129", "RHSA-2021:5107", "RHSA-2021:5108", "RHSA-2021:5134", "RHSA-2021:5137", "RHSA-2021:5126", "RHSA-2021:5148" ], "affected_packages": [ "eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap", "org.apache.logging.log4j/log4j-api:2.17.1.redhat-00002", "eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap", "eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap", "openshift4/ose-metering-hive:v4.6.0-202112140546.p0.g8b9da97.assembly.stream", "openshift4/ose-metering-presto:v4.7.0-202112150631.p0.gd502108.assembly.4.7.40", "eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap", "openshift-logging/elasticsearch6-rhel8:v6.8.1-66", "openshift-logging/elasticsearch6-rhel8:v6.8.1-65", "openshift-logging/elasticsearch6-rhel8:v6.8.1-67", "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap", "eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7", "openshift-logging/elasticsearch6-rhel8:v5.0.10-1", "eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap", "eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7", "eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap", "openshift4/ose-metering-presto:v4.8.0-202112150431.p0.g4b934ae.assembly.art3599", "eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7", "eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7", "eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap", "eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap", "eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7", "eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7", "eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap", "openshift4/ose-metering-hive:v4.7.0-202112140553.p0.g091bb99.assembly.stream", "eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7", "eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap", "openshift4/ose-metering-presto:v4.6.0-202112150545.p0.g190688a.assembly.art3595", "eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap", "openshift3/ose-logging-elasticsearch5:v3.11.570-2.gd119820", "openshift4/ose-metering-hive:v4.8.0-202112132154.p0.g57dd03a.assembly.stream", "openshift4/ose-logging-elasticsearch6:v4.6.0-202112132021.p0.g2a13a81.assembly.stream", "eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7", "log4j-core" ], "bugzilla_description": "log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value", "bugzilla_id": "2030932", "cve_id": "CVE-2021-44228", "cvss2_score": null, "cvss2_vector": null, "cvss3_score": 9.8, "cvss3_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cwe": "CWE-20", "public_date": "2021-12-10T02:01:00Z", "redhat_url": "https://access.redhat.com/security/cve/CVE-2021-44228", "severity": "critical" }, { "advisories": [ "RHSA-2022:0507", "RHSA-2022:0527", "RHSA-2022:0449", "RHSA-2022:0448", "RHSA-2022:0524", "RHSA-2022:0447", "RHSA-2022:0446", "RHSA-2022:0445", "RHSA-2022:0444", "RHSA-2022:0289", "RHSA-2022:5460", "RHSA-2022:0661", "RHSA-2022:1299", "RHSA-2022:1297", "RHSA-2022:1296", "RHSA-2024:5856", "RHSA-2021:5141", "RHSA-2021:5186", "RHSA-2022:0438", "RHSA-2022:0437", "RHSA-2022:0436", "RHSA-2021:5183", "RHSA-2022:0435", "RHSA-2021:5184", "RHSA-2024:10207", "RHSA-2022:0553", "RHSA-2022:0497", "RHSA-2022:0475", "RHSA-2022:0430", "RHSA-2022:0450", "RHSA-2022:0294", "RHSA-2022:0291", "RHSA-2022:0290", "RHSA-2022:5459", "RHSA-2022:5458", "RHSA-2021:5206", "RHSA-2021:5107", "RHSA-2021:5148", "RHSA-2021:5269" ], "affected_packages": [ "jboss-as-xts-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "log4j-0:1.2.17-17.el7_4", "rh-sso7-keycloak-0:15.0.4-1.redhat_00003.1.el8sso", "rh-sso-7/sso74-openshift-rhel8:7.4-45", "eap7-log4j-jboss-logmanager-0:1.2.2-1.Final_redhat_00002.1.el7eap", "jboss-as-core-security-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-naming-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-core-security-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-naming-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "eap7-wss4j-0:2.3.3-2.redhat_00001.1.el7eap", "jboss-as-jdr-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-platform-mbean-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "tomcat8-0:8.0.36-49.ep7.el7", "jboss-as-jdr-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-platform-mbean-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-cli-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-xts-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-cli-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-transactions-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-process-controller-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-process-controller-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "log4j-0:1.2.14-6.5.el6_10", "jboss-as-threads-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "log4j-jboss-logmanager-0:1.1.4-3.Final_redhat_00002.1.ep6.el6", "log4j-jboss-logmanager-0:1.1.4-3.Final_redhat_00002.1.ep6.el7", "jboss-as-domain-management-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "openshift4/ose-metering-hive:v4.8.0-202112160147.p0.g5672016.assembly.stream", "jboss-as-domain-management-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-threads-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "parfait:0.5-8010020220124232535.d5701770", "jboss-as-messaging-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-modcluster-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "openshift4/ose-metering-hadoop:v4.8.0-202112150431.p0.gebd9cb4.assembly.art3599", "jboss-as-messaging-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-modcluster-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "openshift4/ose-metering-presto:v4.8.0-202112150431.p0.g4b934ae.assembly.art3599", "jbossas-modules-eap-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jbossts-1:4.17.45-2.Final_redhat_2.1.ep6.el7", "eap7-xalan-j2-0:2.7.1-38.redhat_00015.1.el7eap", "jbossts-1:4.17.45-2.Final_redhat_2.1.ep6.el6", "jboss-as-security-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-security-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-controller-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-controller-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "eap7-apache-cxf-0:3.4.10-1.SP1_redhat_00001.1.el7eap", "eap7-jboss-server-migration-0:1.7.2-12.Final_redhat_00013.1.el7eap", "jboss-as-domain-http-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "eap7-log4j-jboss-logmanager-0:1.2.2-2.Final_redhat_00002.1.el7eap", "jboss-as-domain-http-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jbossas-core-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jbossas-core-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-remoting-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "org.jboss.logmanager/log4j-jboss-logmanager:1.2.2.Final-redhat-00002", "jbossas-modules-eap-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-remoting-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "log4j", "eap7-jboss-xnio-base-0:3.7.13-1.Final_redhat_00001.1.el7eap", "jbossas-bundles-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jbossas-bundles-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jbossas-javadocs-0:7.5.24-1.Final_redhat_00001.1.ep6.el7", "jboss-as-network-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "rh-sso-7/sso74-openj9-openshift-rhel8:7.4-60", "jboss-as-configadmin-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-network-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-configadmin-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-deployment-scanner-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-deployment-scanner-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jbossas-javadocs-0:7.5.24-1.Final_redhat_00001.1.ep6.el6", "eap7-log4j-0:2.17.1-1.redhat_00001.1.el8eap", "openshift4/ose-metering-presto:v4.7.0-202112150631.p0.gd502108.assembly.4.7.40", "jboss-as-jpa-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "openshift4/ose-metering-hive:v4.6.0-202112160147.p0.gf139e12.assembly.stream", "jboss-as-jmx-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "eap7-log4j-jboss-logmanager-0:1.2.2-1.Final_redhat_00002.1.ep7.el7", "eap7-jboss-annotations-api_1.3_spec-0:2.0.1-4.Final_redhat_00001.1.el7eap", "parfait:0.5-8050020220124063900.6b489b78", "jboss-as-jmx-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-jpa-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jbossas-welcome-content-eap-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jbossas-welcome-content-eap-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-system-jmx-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-system-jmx-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-protocol-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-jacorb-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-protocol-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-jacorb-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "rh-sso-7/sso75-openshift-rhel8:7.5-17", "jboss-as-sar-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-sar-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "tomcat7-0:7.0.70-46.ep7.el7", "jboss-as-mail-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jbossas-appclient-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-web-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-web-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "openshift4/ose-metering-hadoop:v4.7.0-202112150631.p0.g6046504.assembly.4.7.40", "jbossas-appclient-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-mail-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "openshift4/ose-metering-hadoop:v4.6.0-202112150545.p0.gf381145.assembly.art3595", "openshift4/ose-metering-presto:v4.6.0-202112150545.p0.g190688a.assembly.art3595", "jboss-as-ee-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-ee-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-embedded-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-embedded-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "eap7-avro-0:1.7.6-8.redhat_00003.1.el7eap", "jboss-as-controller-client-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-controller-client-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-webservices-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-webservices-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "log4j-eap6-0:1.2.17-3.redhat_00008.1.ep6.el6", "log4j-eap6-0:1.2.17-3.redhat_00008.1.ep6.el7", "jboss-as-ee-deployment-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-osgi-service-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-ee-deployment-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-osgi-service-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-management-client-content-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-management-client-content-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-connector-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "openshift4/ose-metering-hive:v4.7.0-202112160422.p0.g6a2b6aa.assembly.4.7.40", "jboss-as-pojo-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-connector-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-pojo-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-jaxrs-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-jaxrs-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "eap7-wildfly-0:7.3.11-4.GA_redhat_00002.1.el7eap", "eap7-log4j-jboss-logmanager-0:1.2.2-1.Final_redhat_00002.1.el8eap", "jboss-as-osgi-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-version-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-osgi-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-version-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-clustering-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-clustering-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-ejb3-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-ejb3-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "log4j-0:1.2.17-16.el7_3", "rh-sso-7/sso7-rhel8-operator-bundle:7.5.1-9", "jbossas-product-eap-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-cmp-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-cmp-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-client-all-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-client-all-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "snmp4j-0:3.6.4-0.1.el8ev", "eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.el7eap", "jboss-as-server-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jbossas-product-eap-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-server-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "org.ovirt.engine-root-0:4.4.10.6-1", "eap7-h2database-0:1.4.197-3.redhat_00004.1.el7eap", "jboss-as-deployment-repository-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "parfait:0.5-8020020220124231008.1c5d4e8a", "jboss-as-deployment-repository-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jbossas-domain-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jbossas-domain-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "tomcat-native-0:1.2.23-26.redhat_26.ep7.el7", "jboss-as-osgi-configadmin-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-logging-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-osgi-configadmin-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-jsr77-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-jsr77-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "rh-maven36-log4j12-0:1.2.17-23.3.el7", "jbossas-standalone-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jbossas-standalone-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-jaxr-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "rh-sso7-keycloak-0:15.0.4-1.redhat_00003.1.el7sso", "jboss-as-jsf-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-jsf-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-jaxr-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-host-controller-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "eap7-xml-security-0:2.2.3-2.redhat_00001.1.el7eap", "eap7-log4j-0:2.17.1-1.redhat_00001.1.el7eap", "jboss-as-host-controller-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-transactions-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-weld-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-weld-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-logging-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jbossweb-0:7.5.32-2.Final_redhat_1.2.ep6.el7", "jbossweb-0:7.5.32-2.Final_redhat_1.2.ep6.el6", "jboss-as-appclient-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-picketlink-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "jboss-as-picketlink-0:7.5.24-2.Final_redhat_00001.1.ep6.el6", "jboss-as-appclient-0:7.5.24-2.Final_redhat_00001.1.ep6.el7", "parfait:0.5-8040020220124230039.d304d9ed" ], "bugzilla_description": "log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender", "bugzilla_id": "2031667", "cve_id": "CVE-2021-4104", "cvss2_score": null, "cvss2_vector": null, "cvss3_score": 7.5, "cvss3_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cwe": "CWE-20", "public_date": "2021-12-10T00:00:00Z", "redhat_url": "https://access.redhat.com/security/cve/CVE-2021-4104", "severity": "moderate" } ], "source_url": "https://access.redhat.com/hydra/rest/securitydata/cve.json?package=log4j&after=2021-12-01&before=2022-01-01&per_page=20&page=1" } ```