title: Java deserialization in Chainsaw
description: A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.
problem types: CWE-502 Deserialization of Untrusted Data
affected:
{
product: Apache Chainsaw
vendor: Apache Software Foundation
versions:
lessThan: 2.1.0, status: affected, version: Apache Chainsaw, versionType: custom
}
workarounds: Don't configure Chainsaw to read serialized log events.  Use a different receiver, such as XMLSocketReceiver