Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
Configuration 6 (hide)
|
Configuration 7 (hide)
|
History
No history.
Information
Published : 2019-12-20 17:15
Updated : 2024-11-21 04:32
NVD link : CVE-2019-17571
Mitre link : CVE-2019-17571
CVE.ORG link : CVE-2019-17571
JSON object : View
Products Affected
apache
- log4j
- bookkeeper
oracle
- financial_services_lending_and_leasing
- retail_service_backbone
- application_testing_suite
- primavera_gateway
- rapid_planning
- weblogic_server
- communications_network_integrity
- endeca_information_discovery_studio
- mysql_enterprise_monitor
- retail_extract_transform_and_load
canonical
- ubuntu_linux
netapp
- oncommand_workflow_automation
- oncommand_system_manager
debian
- debian_linux
opensuse
- leap
CWE
CWE-502
Deserialization of Untrusted Data
