CVEvulnerability

CVE-2017-5645

9.8 CRITICAL Published 2017-04-17 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2017-04-17
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-502

Description

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Affected configurations

• apache log4j (>= 2.0 < 2.8.2) • netapp oncommand api services • netapp oncommand insight • netapp oncommand workflow automation • netapp service level manager • netapp snapcenter • netapp storage automation store • redhat fuse 1.0 • redhat enterprise linux 6.0 • redhat enterprise linux 6.7 • redhat enterprise linux 7.0 • redhat enterprise linux 7.3 • redhat enterprise linux 7.4 • redhat enterprise linux 7.5 • redhat enterprise linux 7.6 • redhat enterprise linux desktop 7.0 • redhat enterprise linux server 7.0 • redhat enterprise linux server aus 7.4 • redhat enterprise linux server aus 7.6 • redhat enterprise linux server eus 7.4 • redhat enterprise linux server eus 7.5 • redhat enterprise linux server eus 7.6 • redhat enterprise linux server tus 7.4 • redhat enterprise linux server tus 7.6 • redhat enterprise linux workstation 7.0 • oracle api gateway 11.1.2.4.0 • oracle application testing suite 13.3.0.1 • oracle autovue vuelink integration 21.0.0 • oracle autovue vuelink integration 21.0.1 • oracle banking platform 2.6.0 • oracle banking platform 2.6.1 • oracle banking platform 2.6.2 • oracle bi publisher 11.1.1.7.0 • oracle bi publisher 11.1.1.9.0 • oracle bi publisher 12.2.1.3.0 • oracle bi publisher 12.2.1.4.0 • oracle communications converged application server - service controller 6.1 • oracle communications instant messaging server 10.0.1.3.0 • oracle communications interactive session recorder (>= 6.0 <= 6.2) • oracle communications messaging server (< 8.0.2) • oracle communications network integrity (>= 7.3.2 <= 7.3.6) • oracle communications online mediation controller 6.1 • oracle communications pricing design center 11.1 • oracle communications pricing design center 12.0 • oracle communications service broker 6.0 • oracle communications webrtc session controller (< 7.2) • oracle configuration manager 12.1.2.0.2 • oracle configuration manager 12.1.2.0.5 • oracle endeca information discovery studio 3.2.0 • oracle enterprise data quality 12.2.1.3.0 • oracle enterprise manager base platform 12.1.0.5 • oracle enterprise manager base platform 13.2.0.0 • oracle enterprise manager for fusion middleware 12.1.0.5 • oracle enterprise manager for fusion middleware 13.2.0.0 • oracle enterprise manager for mysql database (<= 13.2.2.0.0) • oracle enterprise manager for oracle database 12.1.0.8 • oracle enterprise manager for oracle database 13.2.2 • oracle enterprise manager for peoplesoft 13.1.1.1 • oracle enterprise manager for peoplesoft 13.2.1.1 • oracle financial services analytical applications infrastructure (>= 7.3.3.0.0 <= 7.3.3.0.2) … and 114 more

Related

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References