CVE-2017-5645
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
- CVSS 3.1
- 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 89% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-25)
- CWE
- CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:log4j
- netapp:oncommand_api_services
- netapp:oncommand_insight
- netapp:oncommand_workflow_automation
- netapp:service_level_manager
- netapp:snapcenter
- netapp:storage_automation_store
- oracle:api_gateway
- oracle:application_testing_suite
- oracle:autovue_vuelink_integration
- oracle:banking_platform
- oracle:bi_publisher
- oracle:communications_converged_application_server_-_service_controller
- oracle:communications_instant_messaging_server
- oracle:communications_interactive_session_recorder
- oracle:communications_messaging_server
- oracle:communications_network_integrity
- oracle:communications_online_mediation_controller
- oracle:communications_pricing_design_center
- oracle:communications_service_broker
- oracle:communications_webrtc_session_controller
- oracle:configuration_manager
- oracle:endeca_information_discovery_studio
- oracle:enterprise_data_quality
- oracle:enterprise_manager_base_platform
- oracle:enterprise_manager_for_fusion_middleware
- oracle:enterprise_manager_for_mysql_database
- oracle:enterprise_manager_for_oracle_database
- oracle:enterprise_manager_for_peoplesoft
- oracle:financial_services_analytical_applications_infrastructure
- oracle:financial_services_behavior_detection_platform
- oracle:financial_services_hedge_management_and_ifrs_valuations
- oracle:financial_services_lending_and_leasing
- oracle:financial_services_loan_loss_forecasting_and_provisioning
- oracle:financial_services_profitability_management
- oracle:financial_services_regulatory_reporting_with_agilereporter
- oracle:flexcube_investor_servicing
- oracle:fusion_middleware_mapviewer
- oracle:goldengate
- oracle:goldengate_application_adapters
- oracle:identity_analytics
- oracle:identity_management_suite
- oracle:identity_manager_connector
- oracle:in-memory_performance-driven_planning
- oracle:instantis_enterprisetrack
- oracle:insurance_calculation_engine
- oracle:insurance_policy_administration
- oracle:insurance_rules_palette
- oracle:jd_edwards_enterpriseone_tools
- oracle:jdeveloper
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fxph-q3j8-mv87 | Maven | org.apache.logging.log4j:log4j | >=2.0 <2.8.2 | 2.8.2 |
| GHSA-fxph-q3j8-mv87 | Maven | org.apache.logging.log4j:log4j-core | >=2.0 <2.8.2 | 2.8.2 |
References
- http://www.openwall.com/lists/oss-security/2019/12/19/2
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html