CVE-2019-17571
Critical
Description
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Apache Log4j
PublishedDec 20, 2019
First seenDec 20, 2019
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- apache bookkeeper4.14.3 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache log4j | v ≤ 1.2.17 | — |
| debian debian_linux | 8.0, 9.0, 10.0 | — |
| canonical ubuntu_linux | 18.04 | — |
| opensuse leap | 15.1 | — |
| netapp oncommand_system_manager | 3.0 ≤ v ≤ 3.1.3 | — |
| netapp oncommand_workflow_automation | No range specified | — |
| oracle application_testing_suite | 13.3.0.1 | — |
| oracle communications_network_integrity | 7.3.2 ≤ v ≤ 7.3.6 | — |
| oracle endeca_information_discovery_studio | 3.2.0 | — |
| oracle financial_services_lending_and_leasing | 14.1.0 ≤ v ≤ 14.8.0, 12.5.0 | — |
| oracle mysql_enterprise_monitor | v ≤ 8.0.29 | — |
| oracle primavera_gateway | 16.2 ≤ v ≤ 16.2.11, 17.12.0 ≤ v ≤ 17.12.7 | — |
| oracle rapid_planning | 12.1, 12.2 | — |
| oracle retail_extract_transform_and_load | 19.0 | — |
| oracle retail_service_backbone | 14.1, 15.0, 16.0 | — |
| oracle weblogic_server | 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 | — |
| apache bookkeeper | v < 4.14.3 | 4.14.3 |
| log4j:log4jMaven | 1.2 ≤ v ≤ 1.2.17 | — |
| org.zenframework.z8.dependencies.commons:log4j-1.2.17Maven | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.