A log4j security update has been released for Oracle Linux 7.

El-errata: ELSA-2022-0442 Important: Oracle Linux 7 log4j security update

Oracle Linux Security Advisory ELSA-2022-0442

  http://linux.oracle.com/errata/ELSA-2022-0442.html

The following updated rpms for Oracle Linux 7 have been uploaded to the Unbreakable Linux Network:

x86_64:
log4j-1.2.17-18.el7_4.noarch.rpm
log4j-javadoc-1.2.17-18.el7_4.noarch.rpm
log4j-manual-1.2.17-18.el7_4.noarch.rpm

SRPMS:
  http://oss.oracle.com/ol7/SRPMS-updates/log4j-1.2.17-18.el7_4.src.rpm

Related CVEs:

CVE-2022-23302
CVE-2022-23305
CVE-2022-23307



Description of changes:

[0:1.2.17-18]
- Fix Unsafe deserialization flaw in Chainsaw log viewer
- Fix SQL injection when application is configured to use JDBCAppender
- Fix remote code execution when application is configured to use JMSSink
- Resolves: CVE-2022-23307, CVE-2022-23305, CVE-2022-23302

_______________________________________________