CVE-2022-23307

A flaw was found in the log4j 1.x chainsaw component, where the contents of certain log entries are deserialized and possibly permit code execution. This flaw allows an attacker to send a malicious request with serialized data to the server to be deserialized when the chainsaw component is run.

Mitigation

These are the mitigations available for this flaw for log4j 1.x:
- Avoid using Chainsaw to view logs, and instead use some other utility, especially if there is a log view available within the product itself.
- Remove the Chainsaw classes from the log4j jar files. For example:

zip -q -d log4j-*.jar org/apache/log4j/chainsaw/*  

(log4j jars may be nested in zip archives within product)