CVEvulnerability

CVE-2019-17571

9.8 CRITICAL Published 2019-12-20 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-12-20
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-502

Description

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

Affected configurations

• apache log4j (<= 1.2.17) • debian debian linux 8.0 • debian debian linux 9.0 • debian debian linux 10.0 • canonical ubuntu linux 18.04 • opensuse leap 15.1 • netapp oncommand system manager (>= 3.0 <= 3.1.3) • netapp oncommand workflow automation • oracle application testing suite 13.3.0.1 • oracle communications network integrity (>= 7.3.2 <= 7.3.6) • oracle endeca information discovery studio 3.2.0 • oracle financial services lending and leasing (>= 14.1.0 <= 14.8.0) • oracle financial services lending and leasing 12.5.0 • oracle mysql enterprise monitor (<= 8.0.29) • oracle primavera gateway (>= 16.2 <= 16.2.11) • oracle primavera gateway (>= 17.12.0 <= 17.12.7) • oracle rapid planning 12.1 • oracle rapid planning 12.2 • oracle retail extract transform and load 19.0 • oracle retail service backbone 14.1 • oracle retail service backbone 15.0 • oracle retail service backbone 16.0 • oracle weblogic server 10.3.6.0.0 • oracle weblogic server 12.1.3.0.0 • oracle weblogic server 12.2.1.3.0 • oracle weblogic server 12.2.1.4.0 • oracle weblogic server 14.1.1.0.0 • apache bookkeeper (< 4.14.3)

Related

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References