title:  A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.
description: CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.
problem types: CWE-502 Deserialization of Untrusted Data
affected:
{
product: Apache Log4j 1.x
vendor: Apache Software Foundation
versions:
lessThan: unspecified, status: affected, version: 1.2.1, versionType: custom
lessThanOrEqual: 2.0-alpha1, status: affected, version: unspecified, versionType: custom
}
metrics:
other: [
content: {'other': 'Critical'}
type: unknown
]
workarounds: Upgrade to Apache Log4j 2 and Apache Chainsaw 2.1.0.