CVE-2019-17571
Severity
9.8CRITICAL
EPSS
37.0%
top 2.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 20
Latest updateApr 5
Description
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages18 packages
Also affects: Debian Linux 10.0, 8.0, 9.0, Ubuntu Linux 18.04
Patches
🔴Vulnerability Details
6📋Vendor Advisories
7Oracle▶
Oracle Oracle Communications Applications Risk Matrix: Message Bus (Apache Log4j) — CVE-2019-17571↗2023-01-15
Oracle
▶
🕵️Threat Intelligence
1Unit42▶
Another Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021-44228) (Updated)↗2021-12-10
💬Community
3Bugzilla▶
CVE-2019-17571 log4j12: log4j: deserialization of untrusted data in SocketServer [fedora-all]↗2019-12-20
Bugzilla
▶