CVE-2017-5645
Critical · CVSS 9.8- CVSS
- 9.8
- nvd
- EPSS
- —
- KEV
- No
- Class
- oss containerizable
- CWE-502
Description
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
Affected packages
| Maven | org.apache.logging.log4j:log4j | 2.0 → 2.8.2 |
| Maven | org.apache.logging.log4j:log4j-core | 2.0 → 2.8.2 |
References
- http://www.openwall.com/lists/oss-security/2019/12/19/2
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/97702
- http://www.securitytracker.com/id/1040200
- http://www.securitytracker.com/id/1041294
- https://access.redhat.com/errata/RHSA-2017:1417
- https://access.redhat.com/errata/RHSA-2017:1801
- https://access.redhat.com/errata/RHSA-2017:1802
- https://access.redhat.com/errata/RHSA-2017:2423
Status: profiled · ingested 2026-10-09T00:00:43.000Z