CVE:CVE-2022-23302
CNNVD:CNNVD-202201-1420
Apache Log4j是美国阿帕奇（Apache）基金会的一款基于Java的开源日志记录工具。
Log4j 存在代码问题漏洞，该漏洞源于当攻击者对 Log4j 配置具有写访问权限或配置引用攻击者有权访问的 LDAP 服务时，所有 Log4j 1.x 版本中的 JMSSink 都容易受到不受信任数据的反序列化。 攻击者可以提供一个 TopicConnectionFactoryBindingName 配置，使 JMSSink 执行 JNDI 请求，从而以类似于 CVE-2021-4104 的方式执行远程代码。 请注意，此问题仅在专门配置为使用 JMSSink（不是默认设置）时影响 Log4j 1.x。 Apache Log4j 1.2 已于 2015 年 8 月结束生命周期。用户应升级到 Log4j 2，因为它解决了以前版本中的许多其他问题。
solution:Upgrade apache log4j to a higher version than 1.2.17,and avoid the version [1.0.1,1.2.17]; Upgrade netapp snapmanager to a higher version than -; Upgrade broadcom brocade_sannav to a higher version than -; Upgrade qos reload4j to a higher version than 1.2.18.1,and avoid the version (,1.2.18.1); Upgrade oracle advanced_supply_chain_planning to a higher version than 12.1,12.2,and avoid the version 12.1,12.2; Upgrade oracle business_intelligence to a higher version than 5.9.0.0.0,12.2.1.3.0,12.2.1.4.0,and avoid the version 5.9.0.0.0,12.2.1.3.0,12.2.1.4.0; Upgrade oracle business_process_management_suite to a higher version than 12.2.1.3.0,12.2.1.4.0,and avoid the version 12.2.1.3.0,12.2.1.4.0; Upgrade oracle communications_eagle_ftp_table_base_retrieval to a higher version than 4.5,and avoid the version 4.5; Upgrade oracle communications_instant_messaging_server to a higher version than 10.0.1.5.0,and avoid the version 10.0.1.5.0; Upgrade oracle communications_messaging_server to a higher version than 8.1,and avoid the version 8.1; Upgrade oracle communications_network_integrity to a higher version than 7.3.6,and avoid the version 7.3.6; Upgrade oracle communications_offline_mediation_controller to a higher version than 12.0.0.4.4,12.0.0.5.0,and avoid the version (,12.0.0.4.4),12.0.0.5.0; Upgrade oracle communications_unified_inventory_management to a higher version than 7.4.1,7.4.2,and avoid the version 7.4.1,7.4.2; Upgrade oracle e-business_suite_cloud_manager_and_cloud_backup_module to a higher version than 2.2.1.1.1,2.2.1.1.1,and avoid the version (,2.2.1.1.1),2.2.1.1.1; Upgrade oracle enterprise_manager_base_platform to a higher version than 13.4.0.0,13.5.0.0,and avoid the version 13.4.0.0,13.5.0.0; Upgrade oracle financial_services_revenue_management_and_billing_analytics to a higher version than 2.7.0.0,2.7.0.1,2.8.0.0,and avoid the version 2.7.0.0,2.7.0.1,2.8.0.0; Upgrade oracle healthcare_foundation to a higher version than 8.1.0,and avoid the version 8.1.0; Upgrade oracle hyperion_data_relationship_management to a higher version than 11.2.8.0,and avoid the version (,11.2.8.0); Upgrade oracle hyperion_infrastructure_technology to a higher version than 11.2.8.0,and avoid the version (,11.2.8.0); Upgrade oracle identity_management_suite to a higher version than 12.2.1.3.0,12.2.1.4.0,and avoid the version 12.2.1.3.0,12.2.1.4.0; Upgrade oracle identity_manager_connector to a higher version than 11.1.1.5.0,and avoid the version 11.1.1.5.0; Upgrade oracle jdeveloper to a higher version than 12.2.1.3.0,and avoid the version 12.2.1.3.0; Upgrade oracle middleware_common_libraries_and_tools to a higher version than 12.2.1.4.0,and avoid the version 12.2.1.4.0; Upgrade oracle mysql_enterprise_monitor to a higher version than 8.0.29,and avoid the version (,8.0.29]; Upgrade oracle tuxedo to a higher version than 12.2.2.0.0,and avoid the version 12.2.2.0.0; Upgrade oracle weblogic_server to a higher version than 12.2.1.3.0,12.2.1.4.0,14.1.1.0.0,and avoid the version 12.2.1.3.0,12.2.1.4.0,14.1.1.0.0