GitHub Advisoryadvisory · Maven

GHSA-fxph-q3j8-mv87 Deserialization of Untrusted Data in Log4j

CRITICAL Published 2020-01-06 Modified 2022-04-01 Official page ↗
Aliases
CVE-2017-5645
Ecosystem
Maven
Packages
org.apache.logging.log4j:log4j, org.apache.logging.log4j:log4j-core
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2019-12-27

Affected packages

• Maven org.apache.logging.log4j:log4j: >= 2.0, < 2.8.2 → fixed in 2.8.2 • Maven org.apache.logging.log4j:log4j-core: >= 2.0, < 2.8.2 → fixed in 2.8.2

Description

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Related

Alias · CVE (1)

  • CVE-2017-5645 In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References