CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Vulnerability Details : CVE-2017-5645

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
Publish Date : 2017-04-17 Last Update Date : 2019-06-18
Search Twitter   Search YouTube   Search Google

- CVSS Scores & Vulnerability Types

CVSS Score
7.5
Confidentiality Impact Partial (There is considerable informational disclosure.)
Integrity Impact Partial (Modification of some system files or information is possible, but the attacker does not have control over what can be modified, or the scope of what the attacker can affect is limited.)
Availability Impact Partial (There is reduced performance or interruptions in resource availability.)
Access Complexity Low (Specialized access conditions or extenuating circumstances do not exist. Very little knowledge or skill is required to exploit. )
Authentication Not required (Authentication is not required to exploit the vulnerability.)
Gained Access None
Vulnerability Type(s) Execute Code
CWE ID 502

- Related OVAL Definitions

Title Definition Id Class Family
RHSA-2017:2423: log4j security update (Important) oval:com.redhat.rhsa:def:20172423 unix
OVAL (Open Vulnerability and Assessment Language) definitions define exactly what should be done to verify a vulnerability or a missing patch. Check out the OVAL definitions if you want to learn what you should do to verify a vulnerability.

- Products Affected By CVE-2017-5645

# Product Type Vendor Product Version Update Edition Language
1 Application Apache Log4j 2.0 Beta3 Version Details Vulnerabilities
2 Application Apache Log4j 2.0 Beta9 Version Details Vulnerabilities
3 Application Apache Log4j 2.0 Beta4 Version Details Vulnerabilities
4 Application Apache Log4j 2.0 Alpha1 Version Details Vulnerabilities
5 Application Apache Log4j 2.0 RC1 Version Details Vulnerabilities
6 Application Apache Log4j 2.0 Beta5 Version Details Vulnerabilities
7 Application Apache Log4j 2.0 Alpha2 Version Details Vulnerabilities
8 Application Apache Log4j 2.0 RC2 Version Details Vulnerabilities
9 Application Apache Log4j 2.0 Beta6 Version Details Vulnerabilities
10 Application Apache Log4j 2.0 Beta1 Version Details Vulnerabilities
11 Application Apache Log4j 2.0 Beta7 Version Details Vulnerabilities
12 Application Apache Log4j 2.0 Beta2 Version Details Vulnerabilities
13 Application Apache Log4j 2.0 Beta8 Version Details Vulnerabilities
14 Application Apache Log4j 2.0.1 Version Details Vulnerabilities
15 Application Apache Log4j 2.0.2 Version Details Vulnerabilities
16 Application Apache Log4j 2.1 Version Details Vulnerabilities
17 Application Apache Log4j 2.2 Version Details Vulnerabilities
18 Application Apache Log4j 2.3 Version Details Vulnerabilities
19 Application Apache Log4j 2.4 Version Details Vulnerabilities
20 Application Apache Log4j 2.4.1 Version Details Vulnerabilities
21 Application Apache Log4j 2.5 Version Details Vulnerabilities
22 Application Apache Log4j 2.6 Version Details Vulnerabilities
23 Application Apache Log4j 2.6.1 Version Details Vulnerabilities
24 Application Apache Log4j 2.6.2 Version Details Vulnerabilities
25 Application Apache Log4j 2.7 Version Details Vulnerabilities
26 Application Apache Log4j 2.8 Version Details Vulnerabilities
27 Application Apache Log4j 2.8.1 Version Details Vulnerabilities
28 Application Netapp Oncommand Api Services - Version Details Vulnerabilities
29 Application Netapp Oncommand Insight - Version Details Vulnerabilities
30 Application Netapp Oncommand Workflow Automation - Version Details Vulnerabilities
31 Application Netapp Service Level Manager - Version Details Vulnerabilities
32 Application Netapp Snapcenter - Version Details Vulnerabilities
33 Application Netapp Storage Automation Store - Version Details Vulnerabilities
34 Application Oracle Api Gateway 11.1.2.4.0 Version Details Vulnerabilities
35 Application Oracle Autovue Vuelink Integration 21.0.0 Version Details Vulnerabilities
36 Application Oracle Autovue Vuelink Integration 21.0.1 Version Details Vulnerabilities
37 Application Oracle Banking Platform 2.6.0 Version Details Vulnerabilities
38 Application Oracle Banking Platform 2.6.1 Version Details Vulnerabilities
39 Application Oracle Banking Platform 2.6.2 Version Details Vulnerabilities
40 Application Oracle Bi Publisher 11.1.1.7.0 Version Details Vulnerabilities
41 Application Oracle Bi Publisher 11.1.1.9.0 Version Details Vulnerabilities
42 Application Oracle Bi Publisher 12.2.1.3.0 Version Details Vulnerabilities
43 Application Oracle Bi Publisher 12.2.1.4.0 Version Details Vulnerabilities
44 Application Oracle Communications Converged Application Server - Service Controller 6.1 Version Details Vulnerabilities
45 Application Oracle Communications Messaging Server 6.3 Version Details Vulnerabilities
46 Application Oracle Communications Messaging Server 7.0 Version Details Vulnerabilities
47 Application Oracle Communications Messaging Server 7.0.5 Version Details Vulnerabilities
48 Application Oracle Communications Messaging Server 8.0 Version Details Vulnerabilities
49 Application Oracle Communications Online Mediation Controller 6.1 Version Details Vulnerabilities
50 Application Oracle Communications Pricing Design Center 11.1 Version Details Vulnerabilities
51 Application Oracle Communications Pricing Design Center 12.0 Version Details Vulnerabilities
52 Application Oracle Communications Service Broker 6.0 Version Details Vulnerabilities
53 Application Oracle Configuration Manager 12.1.2.0.2 Version Details Vulnerabilities
54 Application Oracle Configuration Manager 12.1.2.0.5 Version Details Vulnerabilities
55 Application Oracle Enterprise Data Quality 12.2.1.3.0 Version Details Vulnerabilities
56 Application Oracle Enterprise Manager Base Platform 12.1.0.5 Version Details Vulnerabilities
57 Application Oracle Enterprise Manager Base Platform 13.2.0.0 Version Details Vulnerabilities
58 Application Oracle Enterprise Manager For Fusion Middleware 12.1.0.5 Version Details Vulnerabilities
59 Application Oracle Enterprise Manager For Fusion Middleware 13.2.0.0 Version Details Vulnerabilities
60 Application Oracle Enterprise Manager For Mysql Database 13.2.2.0.0 Version Details Vulnerabilities
61 Application Oracle Enterprise Manager For Oracle Database 12.1.0.8 Version Details Vulnerabilities
62 Application Oracle Enterprise Manager For Oracle Database 13.2.2 Version Details Vulnerabilities
63 Application Oracle Enterprise Manager For Peoplesoft 13.1.1.1 Version Details Vulnerabilities
64 Application Oracle Enterprise Manager For Peoplesoft 13.2.1.1 Version Details Vulnerabilities
65 Application Oracle Financial Services Analytical Applications Infrastructure 8.0.0.0.0 Version Details Vulnerabilities
66 Application Oracle Financial Services Analytical Applications Infrastructure 8.0.1.0.0 Version Details Vulnerabilities
67 Application Oracle Financial Services Analytical Applications Infrastructure 8.0.2.0.0 Version Details Vulnerabilities
68 Application Oracle Financial Services Analytical Applications Infrastructure 8.0.3.0.0 Version Details Vulnerabilities
69 Application Oracle Financial Services Analytical Applications Infrastructure 8.0.4.0.0 Version Details Vulnerabilities
70 Application Oracle Financial Services Analytical Applications Infrastructure 8.0.5.0.0 Version Details Vulnerabilities
71 Application Oracle Financial Services Behavior Detection Platform 6.1.1 Version Details Vulnerabilities
72 Application Oracle Financial Services Hedge Management And Ifrs Valuations 8.0.4 Version Details Vulnerabilities
73 Application Oracle Financial Services Hedge Management And Ifrs Valuations 8.0.5 Version Details Vulnerabilities
74 Application Oracle Financial Services Loan Loss Forecasting And Provisioning 8.0.4 Version Details Vulnerabilities
75 Application Oracle Financial Services Loan Loss Forecasting And Provisioning 8.0.5 Version Details Vulnerabilities
76 Application Oracle Financial Services Profitability Management 6.1.1 Version Details Vulnerabilities
77 Application Oracle Financial Services Profitability Management 8.0.0.0.0 Version Details Vulnerabilities
78 Application Oracle Financial Services Profitability Management 8.0.1.0.0 Version Details Vulnerabilities
79 Application Oracle Financial Services Profitability Management 8.0.2.0.0 Version Details Vulnerabilities
80 Application Oracle Financial Services Profitability Management 8.0.3.0.0 Version Details Vulnerabilities
81 Application Oracle Financial Services Profitability Management 8.0.4.0.0 Version Details Vulnerabilities
82 Application Oracle Financial Services Profitability Management 8.0.5.0.0 Version Details Vulnerabilities
83 Application Oracle Flexcube Investor Servicing 12.0.4 Version Details Vulnerabilities
84 Application Oracle Flexcube Investor Servicing 12.1.0 Version Details Vulnerabilities
85 Application Oracle Flexcube Investor Servicing 12.3.0 Version Details Vulnerabilities
86 Application Oracle Flexcube Investor Servicing 12.4.0 Version Details Vulnerabilities
87 Application Oracle Flexcube Investor Servicing 14.0.0 Version Details Vulnerabilities
88 Application Oracle Fusion Middleware Mapviewer 12.2.1.2 Version Details Vulnerabilities
89 Application Oracle Fusion Middleware Mapviewer 12.2.1.3 Version Details Vulnerabilities
90 Application Oracle Goldengate Application Adapters 12.3.2.1.1 Version Details Vulnerabilities
91 Application Oracle Identity Analytics 11.1.1.5.8 Version Details Vulnerabilities
92 Application Oracle Identity Management Suite 11.1.2.3.0 Version Details Vulnerabilities
93 Application Oracle Identity Management Suite 12.2.1.3.0 Version Details Vulnerabilities
94 Application Oracle Insurance Calculation Engine 10.1.1 Version Details Vulnerabilities
95 Application Oracle Insurance Calculation Engine 10.2.1 Version Details Vulnerabilities
96 Application Oracle Insurance Policy Administration 10.0 Version Details Vulnerabilities
97 Application Oracle Insurance Policy Administration 10.1 Version Details Vulnerabilities
98 Application Oracle Insurance Policy Administration 10.2 Version Details Vulnerabilities
99 Application Oracle Insurance Policy Administration 11.0 Version Details Vulnerabilities
100 Application Oracle Insurance Rules Palette 10.0 Version Details Vulnerabilities
101 Application Oracle Insurance Rules Palette 10.1 Version Details Vulnerabilities
102 Application Oracle Insurance Rules Palette 10.2 Version Details Vulnerabilities
103 Application Oracle Insurance Rules Palette 11.0 Version Details Vulnerabilities
104 Application Oracle Insurance Rules Palette 11.1 Version Details Vulnerabilities
105 Application Oracle Jd Edwards Enterpriseone Tools 9.2 Version Details Vulnerabilities
106 Application Oracle Jdeveloper 11.1.1.9.0 Version Details Vulnerabilities
107 Application Oracle Jdeveloper 12.1.3.0.0 Version Details Vulnerabilities
108 Application Oracle Jdeveloper 12.2.1.3.0 Version Details Vulnerabilities
109 Application Oracle Mysql Enterprise Monitor 3.4.2.4181 Version Details Vulnerabilities
110 Application Oracle Peoplesoft Enterprise Fin Install 9.2 Version Details Vulnerabilities
111 Application Oracle Policy Automation 10.4.7 Version Details Vulnerabilities
112 Application Oracle Policy Automation 12.1.0 Version Details Vulnerabilities
113 Application Oracle Policy Automation 12.1.1 Version Details Vulnerabilities
114 Application Oracle Policy Automation 12.2.0 Version Details Vulnerabilities
115 Application Oracle Policy Automation 12.2.1 Version Details Vulnerabilities
116 Application Oracle Policy Automation 12.2.2 Version Details Vulnerabilities
117 Application Oracle Policy Automation 12.2.3 Version Details Vulnerabilities
118 Application Oracle Policy Automation 12.2.4 Version Details Vulnerabilities
119 Application Oracle Policy Automation 12.2.5 Version Details Vulnerabilities
120 Application Oracle Policy Automation 12.2.6 Version Details Vulnerabilities
121 Application Oracle Policy Automation 12.2.7 Version Details Vulnerabilities
122 Application Oracle Policy Automation 12.2.8 Version Details Vulnerabilities
123 Application Oracle Policy Automation 12.2.9 Version Details Vulnerabilities
124 Application Oracle Policy Automation 12.2.10 Version Details Vulnerabilities
125 Application Oracle Policy Automation Connector For Siebel 10.4.6 Version Details Vulnerabilities
126 Application Oracle Policy Automation For Mobile Devices 10.4.7 Version Details Vulnerabilities
127 Application Oracle Policy Automation For Mobile Devices 12.1.0 Version Details Vulnerabilities
128 Application Oracle Policy Automation For Mobile Devices 12.1.1 Version Details Vulnerabilities
129 Application Oracle Policy Automation For Mobile Devices 12.2.0 Version Details Vulnerabilities
130 Application Oracle Policy Automation For Mobile Devices 12.2.1 Version Details Vulnerabilities
131 Application Oracle Policy Automation For Mobile Devices 12.2.2 Version Details Vulnerabilities
132 Application Oracle Policy Automation For Mobile Devices 12.2.3 Version Details Vulnerabilities
133 Application Oracle Policy Automation For Mobile Devices 12.2.4 Version Details Vulnerabilities
134 Application Oracle Policy Automation For Mobile Devices 12.2.5 Version Details Vulnerabilities
135 Application Oracle Policy Automation For Mobile Devices 12.2.6 Version Details Vulnerabilities
136 Application Oracle Policy Automation For Mobile Devices 12.2.7 Version Details Vulnerabilities
137 Application Oracle Policy Automation For Mobile Devices 12.2.8 Version Details Vulnerabilities
138 Application Oracle Policy Automation For Mobile Devices 12.2.9 Version Details Vulnerabilities
139 Application Oracle Policy Automation For Mobile Devices 12.2.10 Version Details Vulnerabilities
140 Application Oracle Retail Clearance Optimization Engine 14.0.5 Version Details Vulnerabilities
141 Application Oracle Retail Extract Transform And Load 13.0 Version Details Vulnerabilities
142 Application Oracle Retail Extract Transform And Load 13.1 Version Details Vulnerabilities
143 Application Oracle Retail Extract Transform And Load 13.2 Version Details Vulnerabilities
144 Application Oracle Retail Integration Bus 14.0.0 Version Details Vulnerabilities
145 Application Oracle Retail Integration Bus 14.1.0 Version Details Vulnerabilities
146 Application Oracle Retail Integration Bus 15.0 Version Details Vulnerabilities
147 Application Oracle Retail Integration Bus 16.0 Version Details Vulnerabilities
148 Application Oracle Retail Open Commerce Platform 5.3.0 Version Details Vulnerabilities
149 Application Oracle Retail Open Commerce Platform 6.0.0 Version Details Vulnerabilities
150 Application Oracle Retail Open Commerce Platform 6.0.1 Version Details Vulnerabilities
151 Application Oracle Retail Predictive Application Server 15.0.3 Version Details Vulnerabilities
152 Application Oracle Siebel Ui Framework 18.7 Version Details Vulnerabilities
153 Application Oracle Siebel Ui Framework 18.8 Version Details Vulnerabilities
154 Application Oracle Siebel Ui Framework 18.9 Version Details Vulnerabilities
155 Application Oracle Soa Suite 12.1.3.0.0 Version Details Vulnerabilities
156 Application Oracle Soa Suite 12.2.2.0.0 Version Details Vulnerabilities
157 Application Oracle Tape Library Acsls 8.4 Version Details Vulnerabilities
158 Application Oracle Utilities Work And Asset Management 1.9.1.2.12 Version Details Vulnerabilities
159 OS Redhat Enterprise Linux 6.0 Version Details Vulnerabilities
160 OS Redhat Enterprise Linux 6.7 Version Details Vulnerabilities
161 OS Redhat Enterprise Linux 7.0 Version Details Vulnerabilities
162 OS Redhat Enterprise Linux 7.3 Version Details Vulnerabilities
163 OS Redhat Enterprise Linux 7.4 Version Details Vulnerabilities
164 OS Redhat Enterprise Linux 7.5 Version Details Vulnerabilities
165 OS Redhat Enterprise Linux 7.6 Version Details Vulnerabilities
166 OS Redhat Enterprise Linux Desktop 7.0 Version Details Vulnerabilities
167 OS Redhat Enterprise Linux Server 7.0 Version Details Vulnerabilities
168 OS Redhat Enterprise Linux Server Aus 7.4 Version Details Vulnerabilities
169 OS Redhat Enterprise Linux Server Aus 7.6 Version Details Vulnerabilities
170 OS Redhat Enterprise Linux Server Eus 7.4 Version Details Vulnerabilities
171 OS Redhat Enterprise Linux Server Eus 7.5 Version Details Vulnerabilities
172 OS Redhat Enterprise Linux Server Eus 7.6 Version Details Vulnerabilities
173 OS Redhat Enterprise Linux Server Tus 7.4 Version Details Vulnerabilities
174 OS Redhat Enterprise Linux Server Tus 7.6 Version Details Vulnerabilities
175 OS Redhat Enterprise Linux Workstation 7.0 Version Details Vulnerabilities

- Number Of Affected Versions By Product

Vendor Product Vulnerable Versions
Apache Log4j 27
Netapp Oncommand Api Services 1
Netapp Oncommand Insight 1
Netapp Oncommand Workflow Automation 1
Netapp Service Level Manager 1
Netapp Snapcenter 1
Netapp Storage Automation Store 1
Oracle Api Gateway 1
Oracle Autovue Vuelink Integration 2
Oracle Banking Platform 3
Oracle Bi Publisher 4
Oracle Communications Converged Application Server - Service Controller 1
Oracle Communications Messaging Server 4
Oracle Communications Online Mediation Controller 1
Oracle Communications Pricing Design Center 2
Oracle Communications Service Broker 1
Oracle Configuration Manager 2
Oracle Enterprise Data Quality 1
Oracle Enterprise Manager Base Platform 2
Oracle Enterprise Manager For Fusion Middleware 2
Oracle Enterprise Manager For Mysql Database 1
Oracle Enterprise Manager For Oracle Database 2
Oracle Enterprise Manager For Peoplesoft 2
Oracle Financial Services Analytical Applications Infrastructure 6
Oracle Financial Services Behavior Detection Platform 1
Oracle Financial Services Hedge Management And Ifrs Valuations 2
Oracle Financial Services Loan Loss Forecasting And Provisioning 2
Oracle Financial Services Profitability Management 7
Oracle Flexcube Investor Servicing 5
Oracle Fusion Middleware Mapviewer 2
Oracle Goldengate Application Adapters 1
Oracle Identity Analytics 1
Oracle Identity Management Suite 2
Oracle Insurance Calculation Engine 2
Oracle Insurance Policy Administration 4
Oracle Insurance Rules Palette 5
Oracle Jd Edwards Enterpriseone Tools 1
Oracle Jdeveloper 3
Oracle Mysql Enterprise Monitor 1
Oracle Peoplesoft Enterprise Fin Install 1
Oracle Policy Automation 14
Oracle Policy Automation Connector For Siebel 1
Oracle Policy Automation For Mobile Devices 14
Oracle Retail Clearance Optimization Engine 1
Oracle Retail Extract Transform And Load 3
Oracle Retail Integration Bus 4
Oracle Retail Open Commerce Platform 3
Oracle Retail Predictive Application Server 1
Oracle Siebel Ui Framework 3
Oracle Soa Suite 2
Oracle Tape Library Acsls 1
Oracle Utilities Work And Asset Management 1
Redhat Enterprise Linux 7
Redhat Enterprise Linux Desktop 1
Redhat Enterprise Linux Server 1
Redhat Enterprise Linux Server Aus 2
Redhat Enterprise Linux Server Eus 3
Redhat Enterprise Linux Server Tus 2
Redhat Enterprise Linux Workstation 1

- References For CVE-2017-5645

https://access.redhat.com/errata/RHSA-2017:1802
REDHAT RHSA-2017:1802
https://security.netapp.com/advisory/ntap-20180726-0002/ CONFIRM
https://access.redhat.com/errata/RHSA-2017:2808
REDHAT RHSA-2017:2808
https://access.redhat.com/errata/RHSA-2017:2423
REDHAT RHSA-2017:2423
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
https://security.netapp.com/advisory/ntap-20181107-0002/ CONFIRM
https://issues.apache.org/jira/browse/LOG4J2-1863 CONFIRM
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html CONFIRM
https://access.redhat.com/errata/RHSA-2017:3399
REDHAT RHSA-2017:3399
https://access.redhat.com/errata/RHSA-2017:3400
REDHAT RHSA-2017:3400
https://access.redhat.com/errata/RHSA-2017:3244
REDHAT RHSA-2017:3244
https://access.redhat.com/errata/RHSA-2019:1545
REDHAT RHSA-2019:1545
http://www.securityfocus.com/bid/97702
BID 97702 Apache Log4j CVE-2017-5645 Remote Code Execution Vulnerability Release Date:2019-07-17
http://www.securitytracker.com/id/1040200
SECTRACK 1040200
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html CONFIRM
https://access.redhat.com/errata/RHSA-2017:2888
REDHAT RHSA-2017:2888
https://access.redhat.com/errata/RHSA-2017:2811
REDHAT RHSA-2017:2811
https://access.redhat.com/errata/RHSA-2017:2810
REDHAT RHSA-2017:2810
https://access.redhat.com/errata/RHSA-2017:2889
REDHAT RHSA-2017:2889
https://access.redhat.com/errata/RHSA-2017:2636
REDHAT RHSA-2017:2636
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html CONFIRM
https://access.redhat.com/errata/RHSA-2017:2809
REDHAT RHSA-2017:2809
https://access.redhat.com/errata/RHSA-2017:2635
REDHAT RHSA-2017:2635
https://access.redhat.com/errata/RHSA-2017:2638
REDHAT RHSA-2017:2638
https://access.redhat.com/errata/RHSA-2017:2633
REDHAT RHSA-2017:2633
https://access.redhat.com/errata/RHSA-2017:1801
REDHAT RHSA-2017:1801
https://access.redhat.com/errata/RHSA-2017:1417
REDHAT RHSA-2017:1417
http://www.securitytracker.com/id/1041294
SECTRACK 1041294
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html CONFIRM
https://access.redhat.com/errata/RHSA-2017:2637
REDHAT RHSA-2017:2637
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html CONFIRM

- Metasploit Modules Related To CVE-2017-5645

There are not any metasploit modules related to this CVE entry (Please visit www.metasploit.com for more information)


CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.