CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

CNA Affected

[
  {
    "product": "Apache Log4j 1.x",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "1.2.1",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "2.0-alpha1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]