CVE-2022-23307

CVE-2022-23307 concerns a deserialization vulnerability in the Chainsaw component of Apache Log4j 1.x (Chainsaw bundled with Log4j 1.2.x). The root cause is unsafe deserialization of untrusted data via Chainsaw, allowing potential code execution. Multiple Atlassian products initially bundled Chai...

CVE-2020-9493

CVE-2020-9493 is a deserialization flaw in Apache Chainsaw, a component historically bundled with Log4j 1.2.x. The vulnerability allows remote code execution via improper deserialization, affecting Chainsaw before version 2.1.0. The connected advisories confirm Chainsaw as the vulnerable componen...