CVE:CVE-2022-23305
CNNVD:CNNVD-202201-1421
Apache Log4j是美国阿帕奇（Apache）基金会的一款基于Java的开源日志记录工具。
Apache Log4j 存在SQL注入漏洞，该漏洞源于 Log4j 1.2.x 中的 JDBCAppender 接受 SQL 语句作为配置参数，其中要插入的值是来自 PatternLayout 的转换器。 消息转换器 %m 可能总是包含在内。 这允许攻击者通过将精心制作的字符串输入到记录的应用程序的输入字段或标题中来操纵 SQL，从而允许执行意外的 SQL 查询。 请注意，此问题仅在专门配置为使用 JDBCAppender（不是默认设置）时才会影响 Log4j 1.x。 从 2.0-beta8 版本开始，重新引入了 JDBCAppender，适当支持参数化 SQL 查询，并进一步自定义写入日志的列。 Apache Log4j 1.2 已于 2015 年 8 月结束生命周期。用户应升级到 Log4j 2，因为它解决了以前版本中的许多其他问题。
solution:Upgrade apache log4j to a higher version than 1.2.17,and avoid the version [1.2,1.2.17]; Upgrade netapp snapmanager to a higher version than -; Upgrade broadcom brocade_sannav to a higher version than -; Upgrade qos reload4j to a higher version than 1.2.18.2,and avoid the version (,1.2.18.2); Upgrade oracle advanced_supply_chain_planning to a higher version than 12.1,12.2,and avoid the version 12.1,12.2; Upgrade oracle business_intelligence to a higher version than 5.9.0.0.0,12.2.1.3.0,12.2.1.4.0,and avoid the version 5.9.0.0.0,12.2.1.3.0,12.2.1.4.0; Upgrade oracle business_process_management_suite to a higher version than 12.2.1.3.0,12.2.1.4.0,and avoid the version 12.2.1.3.0,12.2.1.4.0; Upgrade oracle communications_eagle_ftp_table_base_retrieval to a higher version than 4.5,and avoid the version 4.5; Upgrade oracle communications_instant_messaging_server to a higher version than 10.0.1.5.0,and avoid the version 10.0.1.5.0; Upgrade oracle communications_messaging_server to a higher version than 8.1,and avoid the version 8.1; Upgrade oracle communications_network_integrity to a higher version than 7.3.6,and avoid the version 7.3.6; Upgrade oracle communications_offline_mediation_controller to a higher version than 12.0.0.4.4,12.0.0.5.0,and avoid the version (,12.0.0.4.4),12.0.0.5.0; Upgrade oracle communications_unified_inventory_management to a higher version than 7.4.1,7.4.2,and avoid the version 7.4.1,7.4.2; Upgrade oracle e-business_suite_cloud_manager_and_cloud_backup_module to a higher version than 2.2.1.1.1,2.2.1.1.1,and avoid the version (,2.2.1.1.1),2.2.1.1.1; Upgrade oracle e-business_suite_information_discovery to a higher version than 12.2.11,and avoid the version [12.2.3,12.2.11]; Upgrade oracle enterprise_manager_base_platform to a higher version than 13.4.0.0,13.5.0.0,and avoid the version 13.4.0.0,13.5.0.0; Upgrade oracle financial_services_revenue_management_and_billing_analytics to a higher version than 2.7.0.0,2.7.0.1,2.8.0.0,and avoid the version 2.7.0.0,2.7.0.1,2.8.0.0; Upgrade oracle healthcare_foundation to a higher version than 8.1.0,and avoid the version 8.1.0; Upgrade oracle hyperion_data_relationship_management to a higher version than 11.2.8.0,and avoid the version (,11.2.8.0); Upgrade oracle hyperion_infrastructure_technology to a higher version than 11.2.8.0,and avoid the version (,11.2.8.0); Upgrade oracle identity_management_suite to a higher version than 12.2.1.3.0,12.2.1.4.0,and avoid the version 12.2.1.3.0,12.2.1.4.0; Upgrade oracle identity_manager_connector to a higher version than 11.1.1.5.0,and avoid the version 11.1.1.5.0; Upgrade oracle jdeveloper to a higher version than 12.2.1.3.0,and avoid the version 12.2.1.3.0; Upgrade oracle middleware_common_libraries_and_tools to a higher version than 12.2.1.4.0,and avoid the version 12.2.1.4.0; Upgrade oracle mysql_enterprise_monitor to a higher version than 8.0.29,and avoid the version (,8.0.29]; Upgrade oracle retail_extract_transform_and_load to a higher version than 13.2.5,and avoid the version 13.2.5; Upgrade oracle tuxedo to a higher version than 12.2.2.0.0,and avoid the version 12.2.2.0.0; Upgrade oracle weblogic_server to a higher version than 12.2.1.3.0,12.2.1.4.0,14.1.1.0.0,and avoid the version 12.2.1.3.0,12.2.1.4.0,14.1.1.0.0