ALSA-2022:0290

    Dashboard / Vulnerabilities / ALSA-2022:0290

    ALSA-2022:0290

    Published: 26 Jan 2022Last Modified: 4 Feb 2026

    Summary: Important: parfait:0.5 security update

    Details: Parfait is a Java performance monitoring library that collects metrics and exposes them through a variety of outputs. It provides APIs for extracting performance metrics from the JVM and other sources. It interfaces to Performance Co-Pilot (PCP) using the Memory Mapped Value (MMV) machinery for extremely lightweight instrumentation. Security Fix(es): * log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender (CVE-2022-23305) * log4j: Unsafe deserialization flaw in Chainsaw log viewer (CVE-2022-23307) * log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender (CVE-2021-4104) * log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink (CVE-2022-23302) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    References: https://errata.almalinux.org/8/ALSA-2022-0290.html, https://vulners.com/cve/CVE-2021-4104, https://vulners.com/cve/CVE-2022-23302, https://vulners.com/cve/CVE-2022-23305, https://vulners.com/cve/CVE-2022-23307

    Affected packages

    Package

    Name: parfait

    Purl: pkg:rpm/almalinux/parfait

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -0.5.4-4.module_el8.5.0+235+62ea7738

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    ALSA-2022:0290 | CVE-DB