Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
Configuration 6 (hide)
|
Configuration 7 (hide)
|
History
No history.
Information
Published : 2019-12-20 17:15
Updated : 2024-11-21 04:32
NVD link : CVE-2019-17571
Mitre link : CVE-2019-17571
CVE.ORG link : CVE-2019-17571
JSON object : View
Products Affected
oracle
- communications_network_integrity
- retail_service_backbone
- mysql_enterprise_monitor
- rapid_planning
- endeca_information_discovery_studio
- application_testing_suite
- financial_services_lending_and_leasing
- primavera_gateway
- weblogic_server
- retail_extract_transform_and_load
apache
- log4j
- bookkeeper
debian
- debian_linux
netapp
- oncommand_system_manager
- oncommand_workflow_automation
opensuse
- leap
canonical
- ubuntu_linux
CWE
CWE-502
Deserialization of Untrusted Data