GHSA-fxph-q3j8-mv87
Deserialization of Untrusted Data in Log4j
At a glance
- Published
- Updated
- CVE
- CVE-2017-5645
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.apache.logging.log4j:log4j | introduced 2.0, fixed 2.8.2 |
| Maven · org.apache.logging.log4j:log4j-core | introduced 2.0, fixed 2.8.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-5645 ADVISORY
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html WEB
- https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e@%3Cissues.activemq.apache.org%3E WEB
- https://lists.apache.org/thread.html/rcbb79023a7c8494cb389cd3d95420fa9e0d531ece0b780b8c1f99422@%3Ccommits.doris.apache.org%3E WEB
- https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2@%3Cdev.tika.apache.org%3E WEB
- https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7@%3Cdev.tika.apache.org%3E WEB
- https://lists.apache.org/thread.html/rbfa7a0742be4981a3f9356a23d0e1a5f2e1eabde32a1a3d8e41420f8@%3Cgithub.beam.apache.org%3E WEB
- https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf@%3Cissues.activemq.apache.org%3E WEB
- https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead@%3Cissues.activemq.apache.org%3E WEB
- https://lists.apache.org/thread.html/ra9a682bc0a8dff1c5cefdef31c7c25f096d9121207cf2d74e2fc563d@%3Ccommits.logging.apache.org%3E WEB
- https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60@%3Cdev.tika.apache.org%3E WEB
- https://lists.apache.org/thread.html/r9d5c1b558a15d374bd5abd2d3ae3ca7e50e796a0efdcf91e9c5b4cdd@%3Cgithub.beam.apache.org%3E WEB
- https://lists.apache.org/thread.html/r94b5aae09c4bcff5d06cf641be17b00bd83ba7e10cad737bf16a1b8f@%3Cgithub.beam.apache.org%3E WEB
- https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826@%3Cissues.activemq.apache.org%3E WEB
- https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5@%3Cdev.tika.apache.org%3E WEB
- https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1@%3Cdev.tika.apache.org%3E WEB
- https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78@%3Cissues.activemq.apache.org%3E WEB
- https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad@%3Cdev.tika.apache.org%3E WEB
- https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919@%3Cissues.activemq.apache.org%3E WEB
- https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8@%3Cdev.tika.apache.org%3E WEB
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html WEB
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html WEB
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html WEB
- https://www.oracle.com/security-alerts/cpuoct2021.html WEB
- https://www.oracle.com/security-alerts/cpuoct2020.html WEB
- https://www.oracle.com/security-alerts/cpujul2020.html WEB
- https://www.oracle.com/security-alerts/cpujan2022.html WEB
- https://www.oracle.com/security-alerts/cpujan2021.html WEB
- https://www.oracle.com/security-alerts/cpujan2020.html WEB
- https://www.oracle.com/security-alerts/cpuapr2020.html WEB
- https://www.oracle.com/security-alerts/cpuApr2021.html WEB
- https://security.netapp.com/advisory/ntap-20181107-0002 WEB
- https://security.netapp.com/advisory/ntap-20180726-0002 WEB
- https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f@%3Cdev.tika.apache.org%3E WEB
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E WEB
- https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374@%3Cissues.activemq.apache.org%3E WEB
- https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26@%3Cdev.tika.apache.org%3E WEB
- https://lists.apache.org/thread.html/rdbd579dc223f06af826d7de340218ee2f80d8b43fa7e4decb2a63f44@%3Cgithub.beam.apache.org%3E WEB
- https://access.redhat.com/errata/RHSA-2019:1545 WEB
- https://access.redhat.com/errata/RHSA-2017:3400 WEB
- https://access.redhat.com/errata/RHSA-2017:3399 WEB
- https://access.redhat.com/errata/RHSA-2017:3244 WEB
- https://access.redhat.com/errata/RHSA-2017:2889 WEB
- https://access.redhat.com/errata/RHSA-2017:2888 WEB
- https://access.redhat.com/errata/RHSA-2017:2811 WEB
- https://access.redhat.com/errata/RHSA-2017:2810 WEB
- https://access.redhat.com/errata/RHSA-2017:2809 WEB
- https://access.redhat.com/errata/RHSA-2017:2808 WEB
- https://access.redhat.com/errata/RHSA-2017:2638 WEB
- https://access.redhat.com/errata/RHSA-2017:2637 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |