CVE-2019-17571

Severity
9.8CRITICAL
EPSS
37.0%
top 2.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedDec 20
Latest updateApr 5

Description

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages18 packages

Debianapache-log4j1.2< 1.2.17-9+3
Ubuntuapache-log4j1.2< 1.2.17-8+deb10u1ubuntu0.2+3
Mavenlog4j:log4j1.21.2.17
NVDapache/log4j1.2.17
CVEListV5apache_software_foundation/log4jversions up to 1.2.17

Also affects: Debian Linux 10.0, 8.0, 9.0, Ubuntu Linux 18.04

Patches

🔴Vulnerability Details

6
OSV
apache-log4j1.2 vulnerabilities2023-04-05
OSV
Apache Log4j vulnerability2020-09-15
GHSA
Deserialization of Untrusted Data in Log4j2020-01-06
OSV
Deserialization of Untrusted Data in Log4j2020-01-06
OSV
CVE-2019-17571: Included in Log4j 12019-12-20

📋Vendor Advisories

7
Ubuntu
Apache Log4j vulnerabilities2023-04-05
Oracle
Oracle Oracle Communications Applications Risk Matrix: Message Bus (Apache Log4j) — CVE-2019-175712023-01-15
Ubuntu
Apache Log4j vulnerability2020-09-15
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Console (Apache Log4j) — CVE-2019-175712020-04-15
Red Hat
log4j: deserialization of untrusted data in SocketServer2019-12-20

🕵️Threat Intelligence

1
Unit42
Another Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021-44228) (Updated)2021-12-10

💬Community

3
Bugzilla
CVE-2019-17571 log4j: deserialization of untrusted data in SocketServer2019-12-20
Bugzilla
CVE-2019-17571 log4j12: log4j: deserialization of untrusted data in SocketServer [fedora-all]2019-12-20
Bugzilla
CVE-2019-17571 log4j: deserialization of untrusted data in SocketServer [fedora-all]2019-12-20