CVE-2017-5645 Deserialization of Untrusted Data in Log4j
CriticalCVSS 9.8
EPSS 89.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.logging.log4j/log4j(Maven) | >= 2.0, < 2.8.2 | 2.8.2 |
| org.apache.logging.log4j/log4j-core(Maven) | >= 2.0, < 2.8.2 | 2.8.2 |
| org.apache.logging.log4j/log4j(Maven) | = 2.0 | No fix listed |
| org.apache.logging.log4j/log4j(Maven) | = 2.0.1 | No fix listed |
| org.apache.logging.log4j/log4j(Maven) | = 2.0.2 | No fix listed |
| org.apache.logging.log4j/log4j(Maven) | = 2.1 | No fix listed |
| org.apache.logging.log4j/log4j(Maven) | = 2.2 | No fix listed |
| org.apache.logging.log4j/log4j(Maven) | = 2.3 | No fix listed |
| org.apache.logging.log4j/log4j(Maven) | = 2.3.1 | No fix listed |
| org.apache.logging.log4j/log4j(Maven) | = 2.3.2 | No fix listed |
| org.apache.logging.log4j/log4j(Maven) | = 2.4 | No fix listed |
| org.apache.logging.log4j/log4j(Maven) | = 2.4.1 | No fix listed |
| org.apache.logging.log4j/log4j(Maven) | = 2.5 | No fix listed |
| org.apache.logging.log4j/log4j(Maven) | = 2.6 | No fix listed |
| org.apache.logging.log4j/log4j(Maven) | = 2.6.1 | No fix listed |
| org.apache.logging.log4j/log4j(Maven) | = 2.6.2 | No fix listed |
| org.apache.logging.log4j/log4j(Maven) | = 2.7 | No fix listed |
| org.apache.logging.log4j/log4j(Maven) | = 2.8 | No fix listed |
| org.apache.logging.log4j/log4j(Maven) | = 2.8.1 | No fix listed |
| org.apache.logging.log4j/log4j-core(Maven) | = 2.0 | No fix listed |
| org.apache.logging.log4j/log4j-core(Maven) | = 2.0.1 | No fix listed |
| org.apache.logging.log4j/log4j-core(Maven) | = 2.0.2 | No fix listed |
| org.apache.logging.log4j/log4j-core(Maven) | = 2.1 | No fix listed |
| org.apache.logging.log4j/log4j-core(Maven) | = 2.2 | No fix listed |
| org.apache.logging.log4j/log4j-core(Maven) | = 2.3 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.logging.log4j/log4j-core(Maven) | = 2.3.1 | No fix listed |
| org.apache.logging.log4j/log4j-core(Maven) | = 2.3.2 | No fix listed |
| org.apache.logging.log4j/log4j-core(Maven) | = 2.4 | No fix listed |
| org.apache.logging.log4j/log4j-core(Maven) | = 2.4.1 | No fix listed |
| org.apache.logging.log4j/log4j-core(Maven) | = 2.5 | No fix listed |
| org.apache.logging.log4j/log4j-core(Maven) | = 2.6 | No fix listed |
| org.apache.logging.log4j/log4j-core(Maven) | = 2.6.1 | No fix listed |
| org.apache.logging.log4j/log4j-core(Maven) | = 2.6.2 | No fix listed |
| org.apache.logging.log4j/log4j-core(Maven) | = 2.7 | No fix listed |
| org.apache.logging.log4j/log4j-core(Maven) | = 2.8 | No fix listed |
| org.apache.logging.log4j/log4j-core(Maven) | = 2.8.1 | No fix listed |
| debian/apache-log4j2(Debian:12) | < 2.7-2 | 2.7-2 |
| debian/apache-log4j2(Debian:13) | < 2.7-2 | 2.7-2 |
| debian/apache-log4j2(Debian:14) | < 2.7-2 | 2.7-2 |
| Apache Log4j | = All versions between 2.0-alpha1 and 2.8.1 | No fix listed |
| apache log4j | >= 2.0, < 2.8.2 | 2.8.2 |
| netapp oncommand api services | All versions | No fix listed |
| netapp oncommand insight | All versions | No fix listed |
| netapp oncommand workflow automation | All versions | No fix listed |
| netapp service level manager | All versions | No fix listed |
| netapp snapcenter | All versions | No fix listed |
| netapp storage automation store | All versions | No fix listed |
| redhat fuse | = 1.0 | No fix listed |
| redhat enterprise linux | = 6.0 | No fix listed |
| redhat enterprise linux | = 6.7 | No fix listed |
| redhat enterprise linux | = 7.0 | No fix listed |
| redhat enterprise linux | = 7.3 | No fix listed |
| redhat enterprise linux | = 7.4 | No fix listed |
| redhat enterprise linux | = 7.5 | No fix listed |
| redhat enterprise linux | = 7.6 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux server eus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.4 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| oracle api gateway | = 11.1.2.4.0 | No fix listed |
| oracle application testing suite | = 13.3.0.1 | No fix listed |
| oracle autovue vuelink integration | = 21.0.0 | No fix listed |
| oracle autovue vuelink integration | = 21.0.1 | No fix listed |
| oracle banking platform | = 2.6.0 | No fix listed |
| oracle banking platform | = 2.6.1 | No fix listed |
| oracle banking platform | = 2.6.2 | No fix listed |
| oracle bi publisher | = 11.1.1.7.0 | No fix listed |
| oracle bi publisher | = 11.1.1.9.0 | No fix listed |
| oracle bi publisher | = 12.2.1.3.0 | No fix listed |
| oracle bi publisher | = 12.2.1.4.0 | No fix listed |
| oracle communications converged application server - service controller | = 6.1 | No fix listed |
| oracle communications instant messaging server | = 10.0.1.3.0 | No fix listed |
| oracle communications interactive session recorder | >= 6.0, <= 6.2 | No fix listed |
| oracle communications messaging server | < 8.0.2 | 8.0.2 |
| oracle communications network integrity | >= 7.3.2, <= 7.3.6 | No fix listed |
| oracle communications online mediation controller | = 6.1 | No fix listed |
| oracle communications pricing design center | = 11.1 | No fix listed |
| oracle communications pricing design center | = 12.0 | No fix listed |
| oracle communications service broker | = 6.0 | No fix listed |
| oracle communications webrtc session controller | < 7.2 | 7.2 |
| oracle configuration manager | = 12.1.2.0.2 | No fix listed |
| oracle configuration manager | = 12.1.2.0.5 | No fix listed |
| oracle endeca information discovery studio | = 3.2.0 | No fix listed |
| oracle enterprise data quality | = 12.2.1.3.0 | No fix listed |
| oracle enterprise manager base platform | = 12.1.0.5 | No fix listed |
| oracle enterprise manager base platform | = 13.2.0.0 | No fix listed |
| oracle enterprise manager for fusion middleware | = 12.1.0.5 | No fix listed |
| oracle enterprise manager for fusion middleware | = 13.2.0.0 | No fix listed |
| oracle enterprise manager for mysql database | <= 13.2.2.0.0 | No fix listed |
| oracle Enterprise Manager for Oracle Database | = 12.1.0.8 | No fix listed |
| oracle Enterprise Manager for Oracle Database | = 13.2.2 | No fix listed |
| oracle enterprise manager for peoplesoft | = 13.1.1.1 | No fix listed |
| oracle enterprise manager for peoplesoft | = 13.2.1.1 | No fix listed |
| oracle financial services analytical applications infrastructure | >= 7.3.3.0.0, <= 7.3.3.0.2 | No fix listed |
| oracle financial services analytical applications infrastructure | >= 8.0.0.0.0, <= 8.0.7.0.0 | No fix listed |
| oracle Financial Services Behavior Detection Platform | >= 8.0.0.0.0, <= 8.0.4.0.0 | No fix listed |
| oracle Financial Services Behavior Detection Platform | = 6.1.1 | No fix listed |
| oracle financial services hedge management and ifrs valuations | = 8.0.4 | No fix listed |
| oracle financial services hedge management and ifrs valuations | = 8.0.5 | No fix listed |
| oracle financial services lending and leasing | >= 14.1.0, <= 14.8.0 | No fix listed |
| oracle financial services lending and leasing | = 12.5.0 | No fix listed |
| oracle financial services loan loss forecasting and provisioning | = 8.0.4 | No fix listed |
| oracle financial services loan loss forecasting and provisioning | = 8.0.5 | No fix listed |
| oracle financial services profitability management | >= 8.0.0.0.0, <= 8.0.7.0.0 | No fix listed |
| oracle financial services profitability management | = 6.1.1 | No fix listed |
| oracle financial services regulatory reporting with agilereporter | = 8.0.9.2.0 | No fix listed |
| oracle flexcube investor servicing | = 12.0.4 | No fix listed |
| oracle flexcube investor servicing | = 12.1.0 | No fix listed |
| oracle flexcube investor servicing | = 12.3.0 | No fix listed |
| oracle flexcube investor servicing | = 12.4.0 | No fix listed |
| oracle flexcube investor servicing | = 14.0.0 | No fix listed |
| oracle fusion middleware mapviewer | = 12.2.1.2 | No fix listed |
| oracle fusion middleware mapviewer | = 12.2.1.3 | No fix listed |
| oracle goldengate | = 12.3.2.1.1 | No fix listed |
| oracle goldengate application adapters | = 12.3.2.1.1 | No fix listed |
| oracle identity analytics | = 11.1.1.5.8 | No fix listed |
| oracle identity management suite | = 11.1.2.3.0 | No fix listed |
| oracle identity management suite | = 12.2.1.3.0 | No fix listed |
| oracle Identity Manager Connector | = 9.0 | No fix listed |
| oracle in-memory performance-driven planning | = 12.1 | No fix listed |
| oracle in-memory performance-driven planning | = 12.2 | No fix listed |
| oracle instantis enterprisetrack | >= 17.1, <= 17.3 | No fix listed |
| oracle insurance calculation engine | = 10.1.1 | No fix listed |
| oracle insurance calculation engine | = 10.2.1 | No fix listed |
| oracle insurance policy administration | = 10.0 | No fix listed |
| oracle insurance policy administration | = 10.1 | No fix listed |
| oracle insurance policy administration | = 10.2 | No fix listed |
| oracle insurance policy administration | = 11.0 | No fix listed |
| oracle insurance rules palette | = 10.0 | No fix listed |
| oracle insurance rules palette | = 10.1 | No fix listed |
| oracle insurance rules palette | = 10.2 | No fix listed |
| oracle insurance rules palette | = 11.0 | No fix listed |
| oracle insurance rules palette | = 11.1 | No fix listed |
| oracle JD Edwards EnterpriseOne Tools | = 4.0.1.0 | No fix listed |
| oracle JD Edwards EnterpriseOne Tools | = 9.2 | No fix listed |
| oracle jdeveloper | = 11.1.1.9.0 | No fix listed |
| oracle jdeveloper | = 12.1.3.0.0 | No fix listed |
| oracle jdeveloper | = 12.2.1.3.0 | No fix listed |
| oracle mysql enterprise monitor | >= 3.4.0.0, <= 3.4.7.4297 | No fix listed |
| oracle mysql enterprise monitor | >= 4.0.0.0, <= 4.0.4.5235 | No fix listed |
| oracle mysql enterprise monitor | >= 8.0.0.0.0, <= 8.0.0.8131 | No fix listed |
| oracle peoplesoft enterprise fin install | = 9.2 | No fix listed |
| oracle policy automation | = 10.4.7 | No fix listed |
| oracle policy automation | = 12.1.0 | No fix listed |
| oracle policy automation | = 12.1.1 | No fix listed |
| oracle policy automation | = 12.2.0 | No fix listed |
| oracle policy automation | = 12.2.1 | No fix listed |
| oracle policy automation | = 12.2.2 | No fix listed |
| oracle policy automation | = 12.2.3 | No fix listed |
| oracle policy automation | = 12.2.4 | No fix listed |
| oracle policy automation | = 12.2.5 | No fix listed |
| oracle policy automation | = 12.2.6 | No fix listed |
| oracle policy automation | = 12.2.7 | No fix listed |
| oracle policy automation | = 12.2.8 | No fix listed |
| oracle policy automation | = 12.2.9 | No fix listed |
| oracle policy automation | = 12.2.10 | No fix listed |
| oracle policy automation connector for siebel | = 10.4.6 | No fix listed |
| oracle policy automation for mobile devices | = 10.4.7 | No fix listed |
| oracle policy automation for mobile devices | = 12.1.0 | No fix listed |
| oracle policy automation for mobile devices | = 12.1.1 | No fix listed |
| oracle policy automation for mobile devices | = 12.2.0 | No fix listed |
| oracle policy automation for mobile devices | = 12.2.1 | No fix listed |
| oracle policy automation for mobile devices | = 12.2.2 | No fix listed |
| oracle policy automation for mobile devices | = 12.2.3 | No fix listed |
| oracle policy automation for mobile devices | = 12.2.4 | No fix listed |
| oracle policy automation for mobile devices | = 12.2.5 | No fix listed |
| oracle policy automation for mobile devices | = 12.2.6 | No fix listed |
| oracle policy automation for mobile devices | = 12.2.7 | No fix listed |
| oracle policy automation for mobile devices | = 12.2.8 | No fix listed |
| oracle policy automation for mobile devices | = 12.2.9 | No fix listed |
| oracle policy automation for mobile devices | = 12.2.10 | No fix listed |
| oracle primavera gateway | >= 16.2.0, <= 16.2.11 | No fix listed |
| oracle primavera gateway | >= 17.12.0, <= 17.12.7 | No fix listed |
| oracle rapid planning | = 12.1 | No fix listed |
| oracle rapid planning | = 12.2 | No fix listed |
| oracle retail advanced inventory planning | = 14.0 | No fix listed |
| oracle retail advanced inventory planning | = 15.0 | No fix listed |
| oracle retail clearance optimization engine | = 14.0.5 | No fix listed |
| oracle retail extract transform and load | = 13.0 | No fix listed |
| oracle retail extract transform and load | = 13.1 | No fix listed |
| oracle retail extract transform and load | = 13.2 | No fix listed |
| oracle retail extract transform and load | = 19.0 | No fix listed |
| oracle retail integration bus | = 14.0.0 | No fix listed |
| oracle retail integration bus | = 14.1.0 | No fix listed |
| oracle retail integration bus | = 15.0 | No fix listed |
| oracle retail integration bus | = 16.0 | No fix listed |
| oracle retail open commerce platform | = 5.3.0 | No fix listed |
| oracle retail open commerce platform | = 6.0.0 | No fix listed |
| oracle retail open commerce platform | = 6.0.1 | No fix listed |
| oracle retail predictive application server | = 15.0.3 | No fix listed |
| oracle retail service backbone | = 14.1 | No fix listed |
| oracle retail service backbone | = 15.0 | No fix listed |
| oracle retail service backbone | = 16.0 | No fix listed |
| oracle siebel ui framework | = 18.7 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- RHSA-2017:1417 third-party-advisory vendor-advisory
- RHSA-2017:1801 third-party-advisory vendor-advisory
- RHSA-2017:1802 third-party-advisory vendor-advisory
- RHSA-2017:2423 third-party-advisory vendor-advisory
- RHSA-2017:2633 third-party-advisory vendor-advisory
- RHSA-2017:2635 third-party-advisory vendor-advisory
- RHSA-2017:2636 third-party-advisory vendor-advisory
- RHSA-2017:2637 third-party-advisory vendor-advisory
- RHSA-2017:2638 third-party-advisory vendor-advisory
- RHSA-2017:2808 third-party-advisory vendor-advisory
- RHSA-2017:2809 third-party-advisory vendor-advisory
- RHSA-2017:2810 third-party-advisory vendor-advisory
- RHSA-2017:2811 third-party-advisory vendor-advisory
- RHSA-2017:2888 third-party-advisory vendor-advisory
- RHSA-2017:2889 third-party-advisory vendor-advisory
- RHSA-2017:3244 third-party-advisory vendor-advisory
- RHSA-2017:3399 third-party-advisory vendor-advisory
- RHSA-2017:3400 third-party-advisory vendor-advisory
- RHSA-2019:1545 third-party-advisory vendor-advisory
- issues.apache.org issue-tracking vendor-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- security.netapp.com third-party-advisory
- security.netapp.com third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- [oss-security] 20191218 [CVE-2019-17571] Apache Log4j 1.2 deserialization of untrusted data in SocketServer mailing-list third-party-advisory
- www.oracle.com patch
- www.oracle.com patch
- www.oracle.com patch
- www.oracle.com patch third-party-advisory
- 97702 third-party-advisory vdb-entry
- 1040200 third-party-advisory vdb-entry
- 1041294 third-party-advisory vdb-entry
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- github.com
- github.com product
- Debian Security Tracker CVE-2017-5645 vendor-advisory
- [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities mailing-list
- [logging-dev] 20191215 Re: Is there any chance that there will be a security fix for log4j-v1.2.17? mailing-list
- [logging-dev] 20191218 [CVE-2019-17571] Apache Log4j 1.2 deserialization of untrusted data in SocketServer mailing-list
- [announce] 20191218 [CVE-2019-17571] Apache Log4j 1.2 deserialization of untrusted data in SocketServer mailing-list
- [logging-dev] 20191219 Re: [CVE-2019-17571] Apache Log4j 1.2 deserialization of untrusted data in SocketServer mailing-list
- [activemq-issues] 20191226 [jira] [Created] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 mailing-list
- [tika-dev] 20191226 [jira] [Created] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571 mailing-list
- [tika-dev] 20191226 [jira] [Commented] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571 mailing-list
- [tika-dev] 20191230 [jira] [Created] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] mailing-list
- [activemq-issues] 20191230 [jira] [Created] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10] mailing-list
- [tika-dev] 20200106 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] mailing-list
- [tika-dev] 20200107 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] mailing-list
- [tika-dev] 20200108 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] mailing-list
- [tika-dev] 20200110 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] mailing-list