CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Vulnerability Details : CVE-2017-5645

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
Publish Date : 2017-04-17 Last Update Date : 2022-04-04
Search Twitter   Search YouTube   Search Google

- CVSS Scores & Vulnerability Types

CVSS Score
7.5
Confidentiality Impact Partial (There is considerable informational disclosure.)
Integrity Impact Partial (Modification of some system files or information is possible, but the attacker does not have control over what can be modified, or the scope of what the attacker can affect is limited.)
Availability Impact Partial (There is reduced performance or interruptions in resource availability.)
Access Complexity Low (Specialized access conditions or extenuating circumstances do not exist. Very little knowledge or skill is required to exploit. )
Authentication Not required (Authentication is not required to exploit the vulnerability.)
Gained Access None
Vulnerability Type(s) Execute Code
CWE ID 502

- Related OVAL Definitions

Title Definition Id Class Family
RHSA-2017:2423: log4j security update (Important) oval:com.redhat.rhsa:def:20172423 unix
OVAL (Open Vulnerability and Assessment Language) definitions define exactly what should be done to verify a vulnerability or a missing patch. Check out the OVAL definitions if you want to learn what you should do to verify a vulnerability.

- Products Affected By CVE-2017-5645

# Product Type Vendor Product Version Update Edition Language
1 Application Apache Log4j * * * * Version Details Vulnerabilities
2 Application Netapp Oncommand Api Services - * * * Version Details Vulnerabilities
3 Application Netapp Oncommand Insight - * * * Version Details Vulnerabilities
4 Application Netapp Oncommand Workflow Automation - * * * Version Details Vulnerabilities
5 Application Netapp Service Level Manager - * * * Version Details Vulnerabilities
6 Application Netapp Snapcenter - * * * Version Details Vulnerabilities
7 Application Netapp Storage Automation Store - * * * Version Details Vulnerabilities
8 Application Oracle Api Gateway 11.1.2.4.0 * * * Version Details Vulnerabilities
9 Application Oracle Application Testing Suite 13.3.0.1 * * * Version Details Vulnerabilities
10 Application Oracle Autovue Vuelink Integration 21.0.0 * * * Version Details Vulnerabilities
11 Application Oracle Autovue Vuelink Integration 21.0.1 * * * Version Details Vulnerabilities
12 Application Oracle Banking Platform 2.6.0 * * * Version Details Vulnerabilities
13 Application Oracle Banking Platform 2.6.1 * * * Version Details Vulnerabilities
14 Application Oracle Banking Platform 2.6.2 * * * Version Details Vulnerabilities
15 Application Oracle Bi Publisher 11.1.1.7.0 * * * Version Details Vulnerabilities
16 Application Oracle Bi Publisher 11.1.1.9.0 * * * Version Details Vulnerabilities
17 Application Oracle Bi Publisher 12.2.1.3.0 * * * Version Details Vulnerabilities
18 Application Oracle Bi Publisher 12.2.1.4.0 * * * Version Details Vulnerabilities
19 Application Oracle Communications Converged Application Server - Service Controller 6.1 * * * Version Details Vulnerabilities
20 Application Oracle Communications Instant Messaging Server 10.0.1.3.0 * * * Version Details Vulnerabilities
21 Application Oracle Communications Interactive Session Recorder * * * * Version Details Vulnerabilities
22 Application Oracle Communications Messaging Server * * * * Version Details Vulnerabilities
23 Application Oracle Communications Network Integrity * * * * Version Details Vulnerabilities
24 Application Oracle Communications Online Mediation Controller 6.1 * * * Version Details Vulnerabilities
25 Application Oracle Communications Pricing Design Center 11.1 * * * Version Details Vulnerabilities
26 Application Oracle Communications Pricing Design Center 12.0 * * * Version Details Vulnerabilities
27 Application Oracle Communications Service Broker 6.0 * * * Version Details Vulnerabilities
28 Application Oracle Communications Webrtc Session Controller * * * * Version Details Vulnerabilities
29 Application Oracle Configuration Manager 12.1.2.0.2 * * * Version Details Vulnerabilities
30 Application Oracle Configuration Manager 12.1.2.0.5 * * * Version Details Vulnerabilities
31 Application Oracle Endeca Information Discovery Studio 3.2.0 * * * Version Details Vulnerabilities
32 Application Oracle Enterprise Data Quality 12.2.1.3.0 * * * Version Details Vulnerabilities
33 Application Oracle Enterprise Manager Base Platform 12.1.0.5 * * * Version Details Vulnerabilities
34 Application Oracle Enterprise Manager Base Platform 13.2.0.0 * * * Version Details Vulnerabilities
35 Application Oracle Enterprise Manager For Fusion Middleware 12.1.0.5 * * * Version Details Vulnerabilities
36 Application Oracle Enterprise Manager For Fusion Middleware 13.2.0.0 * * * Version Details Vulnerabilities
37 Application Oracle Enterprise Manager For Mysql Database * * * * Version Details Vulnerabilities
38 Application Oracle Enterprise Manager For Oracle Database 12.1.0.8 * * * Version Details Vulnerabilities
39 Application Oracle Enterprise Manager For Oracle Database 13.2.2 * * * Version Details Vulnerabilities
40 Application Oracle Enterprise Manager For Peoplesoft 13.1.1.1 * * * Version Details Vulnerabilities
41 Application Oracle Enterprise Manager For Peoplesoft 13.2.1.1 * * * Version Details Vulnerabilities
42 Application Oracle Financial Services Analytical Applications Infrastructure * * * * Version Details Vulnerabilities
43 Application Oracle Financial Services Behavior Detection Platform * * * * Version Details Vulnerabilities
44 Application Oracle Financial Services Behavior Detection Platform 6.1.1 * * * Version Details Vulnerabilities
45 Application Oracle Financial Services Hedge Management And Ifrs Valuations 8.0.4 * * * Version Details Vulnerabilities
46 Application Oracle Financial Services Hedge Management And Ifrs Valuations 8.0.5 * * * Version Details Vulnerabilities
47 Application Oracle Financial Services Lending And Leasing * * * * Version Details Vulnerabilities
48 Application Oracle Financial Services Lending And Leasing 12.5.0 * * * Version Details Vulnerabilities
49 Application Oracle Financial Services Loan Loss Forecasting And Provisioning 8.0.4 * * * Version Details Vulnerabilities
50 Application Oracle Financial Services Loan Loss Forecasting And Provisioning 8.0.5 * * * Version Details Vulnerabilities
51 Application Oracle Financial Services Profitability Management * * * * Version Details Vulnerabilities
52 Application Oracle Financial Services Profitability Management 6.1.1 * * * Version Details Vulnerabilities
53 Application Oracle Financial Services Regulatory Reporting With Agilereporter 8.0.9.2.0 * * * Version Details Vulnerabilities
54 Application Oracle Flexcube Investor Servicing 12.0.4 * * * Version Details Vulnerabilities
55 Application Oracle Flexcube Investor Servicing 12.1.0 * * * Version Details Vulnerabilities
56 Application Oracle Flexcube Investor Servicing 12.3.0 * * * Version Details Vulnerabilities
57 Application Oracle Flexcube Investor Servicing 12.4.0 * * * Version Details Vulnerabilities
58 Application Oracle Flexcube Investor Servicing 14.0.0 * * * Version Details Vulnerabilities
59 Application Oracle Fusion Middleware Mapviewer 12.2.1.2 * * * Version Details Vulnerabilities
60 Application Oracle Fusion Middleware Mapviewer 12.2.1.3 * * * Version Details Vulnerabilities
61 Application Oracle Goldengate 12.3.2.1.1 * * * Version Details Vulnerabilities
62 Application Oracle Goldengate Application Adapters 12.3.2.1.1 * * * Version Details Vulnerabilities
63 Application Oracle Identity Analytics 11.1.1.5.8 * * * Version Details Vulnerabilities
64 Application Oracle Identity Management Suite 11.1.2.3.0 * * * Version Details Vulnerabilities
65 Application Oracle Identity Management Suite 12.2.1.3.0 * * * Version Details Vulnerabilities
66 Application Oracle Identity Manager Connector 9.0 * * * Version Details Vulnerabilities
67 Application Oracle In-memory Performance-driven Planning 12.1 * * * Version Details Vulnerabilities
68 Application Oracle In-memory Performance-driven Planning 12.2 * * * Version Details Vulnerabilities
69 Application Oracle Instantis Enterprisetrack * * * * Version Details Vulnerabilities
70 Application Oracle Insurance Calculation Engine 10.1.1 * * * Version Details Vulnerabilities
71 Application Oracle Insurance Calculation Engine 10.2.1 * * * Version Details Vulnerabilities
72 Application Oracle Insurance Policy Administration 10.0 * * * Version Details Vulnerabilities
73 Application Oracle Insurance Policy Administration 10.1 * * * Version Details Vulnerabilities
74 Application Oracle Insurance Policy Administration 10.2 * * * Version Details Vulnerabilities
75 Application Oracle Insurance Policy Administration 11.0 * * * Version Details Vulnerabilities
76 Application Oracle Insurance Rules Palette 10.0 * * * Version Details Vulnerabilities
77 Application Oracle Insurance Rules Palette 10.1 * * * Version Details Vulnerabilities
78 Application Oracle Insurance Rules Palette 10.2 * * * Version Details Vulnerabilities
79 Application Oracle Insurance Rules Palette 11.0 * * * Version Details Vulnerabilities
80 Application Oracle Insurance Rules Palette 11.1 * * * Version Details Vulnerabilities
81 Application Oracle Jd Edwards Enterpriseone Tools 4.0.1.0 * * * Version Details Vulnerabilities
82 Application Oracle Jd Edwards Enterpriseone Tools 9.2 * * * Version Details Vulnerabilities
83 Application Oracle Jdeveloper 11.1.1.9.0 * * * Version Details Vulnerabilities
84 Application Oracle Jdeveloper 12.1.3.0.0 * * * Version Details Vulnerabilities
85 Application Oracle Jdeveloper 12.2.1.3.0 * * * Version Details Vulnerabilities
86 Application Oracle Mysql Enterprise Monitor * * * * Version Details Vulnerabilities
87 Application Oracle Peoplesoft Enterprise Fin Install 9.2 * * * Version Details Vulnerabilities
88 Application Oracle Policy Automation 10.4.7 * * * Version Details Vulnerabilities
89 Application Oracle Policy Automation 12.1.0 * * * Version Details Vulnerabilities
90 Application Oracle Policy Automation 12.1.1 * * * Version Details Vulnerabilities
91 Application Oracle Policy Automation 12.2.0 * * * Version Details Vulnerabilities
92 Application Oracle Policy Automation 12.2.1 * * * Version Details Vulnerabilities
93 Application Oracle Policy Automation 12.2.2 * * * Version Details Vulnerabilities
94 Application Oracle Policy Automation 12.2.3 * * * Version Details Vulnerabilities
95 Application Oracle Policy Automation 12.2.4 * * * Version Details Vulnerabilities
96 Application Oracle Policy Automation 12.2.5 * * * Version Details Vulnerabilities
97 Application Oracle Policy Automation 12.2.6 * * * Version Details Vulnerabilities
98 Application Oracle Policy Automation 12.2.7 * * * Version Details Vulnerabilities
99 Application Oracle Policy Automation 12.2.8 * * * Version Details Vulnerabilities
100 Application Oracle Policy Automation 12.2.9 * * * Version Details Vulnerabilities
101 Application Oracle Policy Automation 12.2.10 * * * Version Details Vulnerabilities
102 Application Oracle Policy Automation Connector For Siebel 10.4.6 * * * Version Details Vulnerabilities
103 Application Oracle Policy Automation For Mobile Devices 10.4.7 * * * Version Details Vulnerabilities
104 Application Oracle Policy Automation For Mobile Devices 12.1.0 * * * Version Details Vulnerabilities
105 Application Oracle Policy Automation For Mobile Devices 12.1.1 * * * Version Details Vulnerabilities
106 Application Oracle Policy Automation For Mobile Devices 12.2.0 * * * Version Details Vulnerabilities
107 Application Oracle Policy Automation For Mobile Devices 12.2.1 * * * Version Details Vulnerabilities
108 Application Oracle Policy Automation For Mobile Devices 12.2.2 * * * Version Details Vulnerabilities
109 Application Oracle Policy Automation For Mobile Devices 12.2.3 * * * Version Details Vulnerabilities
110 Application Oracle Policy Automation For Mobile Devices 12.2.4 * * * Version Details Vulnerabilities
111 Application Oracle Policy Automation For Mobile Devices 12.2.5 * * * Version Details Vulnerabilities
112 Application Oracle Policy Automation For Mobile Devices 12.2.6 * * * Version Details Vulnerabilities
113 Application Oracle Policy Automation For Mobile Devices 12.2.7 * * * Version Details Vulnerabilities
114 Application Oracle Policy Automation For Mobile Devices 12.2.8 * * * Version Details Vulnerabilities
115 Application Oracle Policy Automation For Mobile Devices 12.2.9 * * * Version Details Vulnerabilities
116 Application Oracle Policy Automation For Mobile Devices 12.2.10 * * * Version Details Vulnerabilities
117 Application Oracle Primavera Gateway * * * * Version Details Vulnerabilities
118 Application Oracle Rapid Planning 12.1 * * * Version Details Vulnerabilities
119 Application Oracle Rapid Planning 12.2 * * * Version Details Vulnerabilities
120 Application Oracle Retail Advanced Inventory Planning 14.0 * * * Version Details Vulnerabilities
121 Application Oracle Retail Advanced Inventory Planning 15.0 * * * Version Details Vulnerabilities
122 Application Oracle Retail Clearance Optimization Engine 14.0.5 * * * Version Details Vulnerabilities
123 Application Oracle Retail Extract Transform And Load 13.0 * * * Version Details Vulnerabilities
124 Application Oracle Retail Extract Transform And Load 13.1 * * * Version Details Vulnerabilities
125 Application Oracle Retail Extract Transform And Load 13.2 * * * Version Details Vulnerabilities
126 Application Oracle Retail Extract Transform And Load 19.0 * * * Version Details Vulnerabilities
127 Application Oracle Retail Integration Bus 14.0.0 * * * Version Details Vulnerabilities
128 Application Oracle Retail Integration Bus 14.1.0 * * * Version Details Vulnerabilities
129 Application Oracle Retail Integration Bus 15.0 * * * Version Details Vulnerabilities
130 Application Oracle Retail Integration Bus 16.0 * * * Version Details Vulnerabilities
131 Application Oracle Retail Open Commerce Platform 5.3.0 * * * Version Details Vulnerabilities
132 Application Oracle Retail Open Commerce Platform 6.0.0 * * * Version Details Vulnerabilities
133 Application Oracle Retail Open Commerce Platform 6.0.1 * * * Version Details Vulnerabilities
134 Application Oracle Retail Predictive Application Server 15.0.3 * * * Version Details Vulnerabilities
135 Application Oracle Retail Service Backbone 14.1 * * * Version Details Vulnerabilities
136 Application Oracle Retail Service Backbone 15.0 * * * Version Details Vulnerabilities
137 Application Oracle Retail Service Backbone 16.0 * * * Version Details Vulnerabilities
138 Application Oracle Siebel Ui Framework 18.7 * * * Version Details Vulnerabilities
139 Application Oracle Siebel Ui Framework 18.8 * * * Version Details Vulnerabilities
140 Application Oracle Siebel Ui Framework 18.9 * * * Version Details Vulnerabilities
141 Application Oracle Soa Suite 12.1.3.0.0 * * * Version Details Vulnerabilities
142 Application Oracle Soa Suite 12.2.1.3.0 * * * Version Details Vulnerabilities
143 Application Oracle Soa Suite 12.2.2.0.0 * * * Version Details Vulnerabilities
144 Application Oracle Tape Library Acsls 8.4 * * * Version Details Vulnerabilities
145 Application Oracle Timesten In-memory Database 11.2.2.8.49 * * * Version Details Vulnerabilities
146 Application Oracle Utilities Advanced Spatial And Operational Analytics 2.7.0.1 * * * Version Details Vulnerabilities
147 Application Oracle Utilities Work And Asset Management 1.9.1.2.12 * * * Version Details Vulnerabilities
148 Application Oracle Weblogic Server 10.3.6.0.0 * * * Version Details Vulnerabilities
149 Application Oracle Weblogic Server 12.1.3.0.0 * * * Version Details Vulnerabilities
150 Application Oracle Weblogic Server 12.2.1.3.0 * * * Version Details Vulnerabilities
151 Application Oracle Weblogic Server 12.2.1.4.0 * * * Version Details Vulnerabilities
152 Application Oracle Weblogic Server 14.1.1.0.0 * * * Version Details Vulnerabilities
153 OS Redhat Enterprise Linux 6.0 * * * Version Details Vulnerabilities
154 OS Redhat Enterprise Linux 6.7 * * * Version Details Vulnerabilities
155 OS Redhat Enterprise Linux 7.0 * * * Version Details Vulnerabilities
156 OS Redhat Enterprise Linux 7.3 * * * Version Details Vulnerabilities
157 OS Redhat Enterprise Linux 7.4 * * * Version Details Vulnerabilities
158 OS Redhat Enterprise Linux 7.5 * * * Version Details Vulnerabilities
159 OS Redhat Enterprise Linux 7.6 * * * Version Details Vulnerabilities
160 OS Redhat Enterprise Linux Desktop 7.0 * * * Version Details Vulnerabilities
161 OS Redhat Enterprise Linux Server 7.0 * * * Version Details Vulnerabilities
162 OS Redhat Enterprise Linux Server Aus 7.4 * * * Version Details Vulnerabilities
163 OS Redhat Enterprise Linux Server Aus 7.6 * * * Version Details Vulnerabilities
164 OS Redhat Enterprise Linux Server Eus 7.4 * * * Version Details Vulnerabilities
165 OS Redhat Enterprise Linux Server Eus 7.5 * * * Version Details Vulnerabilities
166 OS Redhat Enterprise Linux Server Eus 7.6 * * * Version Details Vulnerabilities
167 OS Redhat Enterprise Linux Server Tus 7.4 * * * Version Details Vulnerabilities
168 OS Redhat Enterprise Linux Server Tus 7.6 * * * Version Details Vulnerabilities
169 OS Redhat Enterprise Linux Workstation 7.0 * * * Version Details Vulnerabilities
170 Application Redhat Fuse 1.0 * * * Version Details Vulnerabilities

- Number Of Affected Versions By Product

Vendor Product Vulnerable Versions
Apache Log4j 1
Netapp Oncommand Api Services 1
Netapp Oncommand Insight 1
Netapp Oncommand Workflow Automation 1
Netapp Service Level Manager 1
Netapp Snapcenter 1
Netapp Storage Automation Store 1
Oracle Api Gateway 1
Oracle Application Testing Suite 1
Oracle Autovue Vuelink Integration 2
Oracle Banking Platform 3
Oracle Bi Publisher 4
Oracle Communications Converged Application Server - Service Controller 1
Oracle Communications Instant Messaging Server 1
Oracle Communications Interactive Session Recorder 1
Oracle Communications Messaging Server 1
Oracle Communications Network Integrity 1
Oracle Communications Online Mediation Controller 1
Oracle Communications Pricing Design Center 2
Oracle Communications Service Broker 1
Oracle Communications Webrtc Session Controller 1
Oracle Configuration Manager 2
Oracle Endeca Information Discovery Studio 1
Oracle Enterprise Data Quality 1
Oracle Enterprise Manager Base Platform 2
Oracle Enterprise Manager For Fusion Middleware 2
Oracle Enterprise Manager For Mysql Database 1
Oracle Enterprise Manager For Oracle Database 2
Oracle Enterprise Manager For Peoplesoft 2
Oracle Financial Services Analytical Applications Infrastructure 1
Oracle Financial Services Behavior Detection Platform 2
Oracle Financial Services Hedge Management And Ifrs Valuations 2
Oracle Financial Services Lending And Leasing 2
Oracle Financial Services Loan Loss Forecasting And Provisioning 2
Oracle Financial Services Profitability Management 2
Oracle Financial Services Regulatory Reporting With Agilereporter 1
Oracle Flexcube Investor Servicing 5
Oracle Fusion Middleware Mapviewer 2
Oracle Goldengate 1
Oracle Goldengate Application Adapters 1
Oracle Identity Analytics 1
Oracle Identity Management Suite 2
Oracle Identity Manager Connector 1
Oracle In-memory Performance-driven Planning 2
Oracle Instantis Enterprisetrack 1
Oracle Insurance Calculation Engine 2
Oracle Insurance Policy Administration 4
Oracle Insurance Rules Palette 5
Oracle Jd Edwards Enterpriseone Tools 2
Oracle Jdeveloper 3
Oracle Mysql Enterprise Monitor 1
Oracle Peoplesoft Enterprise Fin Install 1
Oracle Policy Automation 14
Oracle Policy Automation Connector For Siebel 1
Oracle Policy Automation For Mobile Devices 14
Oracle Primavera Gateway 1
Oracle Rapid Planning 2
Oracle Retail Advanced Inventory Planning 2
Oracle Retail Clearance Optimization Engine 1
Oracle Retail Extract Transform And Load 4
Oracle Retail Integration Bus 4
Oracle Retail Open Commerce Platform 3
Oracle Retail Predictive Application Server 1
Oracle Retail Service Backbone 3
Oracle Siebel Ui Framework 3
Oracle Soa Suite 3
Oracle Tape Library Acsls 1
Oracle Timesten In-memory Database 1
Oracle Utilities Advanced Spatial And Operational Analytics 1
Oracle Utilities Work And Asset Management 1
Oracle Weblogic Server 5
Redhat Enterprise Linux 7
Redhat Enterprise Linux Desktop 1
Redhat Enterprise Linux Server 1
Redhat Enterprise Linux Server Aus 2
Redhat Enterprise Linux Server Eus 3
Redhat Enterprise Linux Server Tus 2
Redhat Enterprise Linux Workstation 1
Redhat Fuse 1

- References For CVE-2017-5645

https://lists.apache.org/thread.html/[email protected]%3Cgithub.beam.apache.org%3E
MLIST [beam-github] 20210701 [GitHub] [beam] codecov[bot] commented on pull request #15113: [BEAM-12422] Upgrade log4j version not affected by CVE-2017-5645
https://www.oracle.com/security-alerts/cpuoct2021.html
https://lists.apache.org/thread.html/[email protected]%3Cissues.bookkeeper.apache.org%3E
MLIST [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image
https://access.redhat.com/errata/RHSA-2017:1802
REDHAT RHSA-2017:1802
https://lists.apache.org/thread.html/[email protected]%3Cgithub.beam.apache.org%3E
MLIST [beam-github] 20210701 [GitHub] [beam] lukecwik commented on pull request #15113: [BEAM-12422] Upgrade log4j version not affected by CVE-2017-5645
https://lists.apache.org/thread.html/[email protected]%3Cgithub.beam.apache.org%3E
MLIST [beam-github] 20210701 [GitHub] [beam] suztomo commented on pull request #15113: [BEAM-12422] Upgrade log4j version not affected by CVE-2017-5645
http://www.securitytracker.com/id/1040200
SECTRACK 1040200
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html CONFIRM
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html CONFIRM
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html CONFIRM
https://security.netapp.com/advisory/ntap-20180726-0002/ CONFIRM
http://www.securitytracker.com/id/1041294
SECTRACK 1041294
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html CONFIRM
https://security.netapp.com/advisory/ntap-20181107-0002/ CONFIRM
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html CONFIRM
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
https://access.redhat.com/errata/RHSA-2019:1545
REDHAT RHSA-2019:1545
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
https://lists.apache.org/thread.html/[email protected]%3Ccommits.druid.apache.org%3E
MLIST [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities
https://lists.apache.org/thread.html/[email protected]%3Cdev.logging.apache.org%3E
MLIST [logging-dev] 20191215 Re: Is there any chance that there will be a security fix for log4j-v1.2.17?
https://lists.apache.org/thread.html/[email protected]%3Cdev.logging.apache.org%3E
MLIST [logging-dev] 20191218 [CVE-2019-17571] Apache Log4j 1.2 deserialization of untrusted data in SocketServer
https://lists.apache.org/thread.html/[email protected]%3Cannounce.apache.org%3E
MLIST [announce] 20191218 [CVE-2019-17571] Apache Log4j 1.2 deserialization of untrusted data in SocketServer
http://www.openwall.com/lists/oss-security/2019/12/19/2
MLIST [oss-security] 20191218 [CVE-2019-17571] Apache Log4j 1.2 deserialization of untrusted data in SocketServer
https://lists.apache.org/thread.html/[email protected]%3Cdev.logging.apache.org%3E
MLIST [logging-dev] 20191219 Re: [CVE-2019-17571] Apache Log4j 1.2 deserialization of untrusted data in SocketServer
https://lists.apache.org/thread.html/[email protected]%3Cissues.activemq.apache.org%3E
MLIST [activemq-issues] 20191226 [jira] [Created] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571
https://lists.apache.org/thread.html/[email protected]%3Cdev.tika.apache.org%3E
MLIST [tika-dev] 20191226 [jira] [Created] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571
https://lists.apache.org/thread.html/[email protected]%3Cdev.tika.apache.org%3E
MLIST [tika-dev] 20191226 [jira] [Commented] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571
https://lists.apache.org/thread.html/[email protected]%3Cdev.tika.apache.org%3E
MLIST [tika-dev] 20191230 [jira] [Created] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]
https://lists.apache.org/thread.html/[email protected]%3Cissues.activemq.apache.org%3E
MLIST [activemq-issues] 20191230 [jira] [Created] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10]
https://lists.apache.org/thread.html/[email protected]%3Cdev.tika.apache.org%3E
MLIST [tika-dev] 20200106 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]
https://lists.apache.org/thread.html/[email protected]%3Cdev.tika.apache.org%3E
MLIST [tika-dev] 20200107 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]
https://lists.apache.org/thread.html/[email protected]%3Cdev.tika.apache.org%3E
MLIST [tika-dev] 20200108 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]
https://lists.apache.org/thread.html/[email protected]%3Cdev.tika.apache.org%3E
MLIST [tika-dev] 20200110 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]
https://lists.apache.org/thread.html/[email protected]%3Cdev.tika.apache.org%3E
MLIST [tika-dev] 20200111 Re: [jira] [Commented] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571
https://lists.apache.org/thread.html/[email protected]%3Cdev.tika.apache.org%3E
MLIST [tika-dev] 20200111 [jira] [Resolved] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571
https://lists.apache.org/thread.html/[email protected]%3Cdev.tika.apache.org%3E
MLIST [tika-dev] 20200111 [jira] [Closed] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571
https://lists.apache.org/thread.html/[email protected]%3Cdev.tika.apache.org%3E
MLIST [tika-dev] 20200114 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]
https://lists.apache.org/thread.html/[email protected]%3Cdev.tika.apache.org%3E
MLIST [tika-dev] 20200115 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23]
https://www.oracle.com/security-alerts/cpujan2020.html
https://lists.apache.org/thread.html/[email protected]%3Cissues.activemq.apache.org%3E
MLIST [activemq-issues] 20200122 [jira] [Assigned] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10]
https://lists.apache.org/thread.html/[email protected]%3Cissues.activemq.apache.org%3E
MLIST [activemq-issues] 20200122 [jira] [Updated] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571
https://lists.apache.org/thread.html/[email protected]%3Cissues.activemq.apache.org%3E
MLIST [activemq-issues] 20200122 [jira] [Assigned] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571
https://lists.apache.org/thread.html/[email protected]%3Cissues.activemq.apache.org%3E
MLIST [activemq-issues] 20200122 [jira] [Updated] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10]
https://lists.apache.org/thread.html/[email protected]%3Cissues.activemq.apache.org%3E
MLIST [activemq-issues] 20200122 [jira] [Resolved] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10]
https://lists.apache.org/thread.html/[email protected]%3Cissues.activemq.apache.org%3E
MLIST [activemq-issues] 20200127 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571
https://lists.apache.org/thread.html/[email protected]%3Cissues.activemq.apache.org%3E
MLIST [activemq-issues] 20200208 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571
https://lists.apache.org/thread.html/[email protected]%3Cissues.activemq.apache.org%3E
MLIST [activemq-issues] 20200228 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571
https://lists.apache.org/thread.html/[email protected]%3Cissues.activemq.apache.org%3E
MLIST [activemq-issues] 20200228 [jira] [Updated] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571
https://lists.apache.org/thread.html/[email protected]%3Cissues.activemq.apache.org%3E
MLIST [activemq-issues] 20200228 [jira] [Resolved] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571
https://www.oracle.com/security-alerts/cpujan2022.html
https://access.redhat.com/errata/RHSA-2017:2810
REDHAT RHSA-2017:2810
https://lists.apache.org/thread.html/[email protected]%3Cissues.geode.apache.org%3E
MLIST [geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12
https://lists.apache.org/thread.html/r0831e2e52a390758ce39a6193f82c11c295175adce6e6307de2[email protected]%3Cissues.beam.apache.org%3E
MLIST [beam-issues] 20210528 [jira] [Created] (BEAM-12422) Vendored gRPC 1.36.0 is using a log4j version with security issues
https://www.oracle.com/security-alerts/cpuApr2021.html
https://lists.apache.org/thread.html/[email protected]%3Ccommits.doris.apache.org%3E
MLIST [doris-commits] 20210402 [GitHub] [incubator-doris] zh0122 opened a new pull request #5594: [FE][Bug]Update log4j-web to fix a security issue
https://www.oracle.com/security-alerts/cpujan2021.html
https://access.redhat.com/errata/RHSA-2017:2638
REDHAT RHSA-2017:2638
https://access.redhat.com/errata/RHSA-2017:2637
REDHAT RHSA-2017:2637
https://www.oracle.com/security-alerts/cpuoct2020.html
https://lists.apache.org/thread.html/[email protected]%3Cissues.activemq.apache.org%3E
MLIST [activemq-issues] 20200730 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571
https://www.oracle.com/security-alerts/cpujul2020.html
https://lists.apache.org/thread.html/[email protected]%3Ccommits.logging.apache.org%3E
MLIST [logging-commits] 20200425 svn commit: r1059809 - /websites/production/logging/content/log4j/2.13.2/security.html
https://www.oracle.com/security-alerts/cpuapr2020.html
N/A N/A
https://access.redhat.com/errata/RHSA-2017:1417
REDHAT RHSA-2017:1417
https://access.redhat.com/errata/RHSA-2017:1801
REDHAT RHSA-2017:1801
https://access.redhat.com/errata/RHSA-2017:2636
REDHAT RHSA-2017:2636
https://access.redhat.com/errata/RHSA-2017:2635
REDHAT RHSA-2017:2635
https://access.redhat.com/errata/RHSA-2017:2423
REDHAT RHSA-2017:2423
https://access.redhat.com/errata/RHSA-2017:2633
REDHAT RHSA-2017:2633
https://lists.apache.org/thread.html/[email protected]%3Cgithub.beam.apache.org%3E
MLIST [beam-github] 20210701 [GitHub] [beam] lukecwik opened a new pull request #15113: [BEAM-12422] Upgrade log4j version not affected by CVE-2017-5645
https://access.redhat.com/errata/RHSA-2017:3400
REDHAT RHSA-2017:3400
https://access.redhat.com/errata/RHSA-2017:3399
REDHAT RHSA-2017:3399
https://lists.apache.org/thread.html/[email protected]%3Cgithub.beam.apache.org%3E
MLIST [beam-github] 20210701 [GitHub] [beam] codecov[bot] edited a comment on pull request #15113: [BEAM-12422] Upgrade log4j version not affected by CVE-2017-5645
https://access.redhat.com/errata/RHSA-2017:2808
REDHAT RHSA-2017:2808
https://access.redhat.com/errata/RHSA-2017:2888
REDHAT RHSA-2017:2888
https://access.redhat.com/errata/RHSA-2017:2809
REDHAT RHSA-2017:2809
https://access.redhat.com/errata/RHSA-2017:2811
REDHAT RHSA-2017:2811
http://www.securityfocus.com/bid/97702
BID 97702 Apache Log4j CVE-2017-5645 Remote Code Execution Vulnerability Release Date:2019-07-17
https://access.redhat.com/errata/RHSA-2017:3244
REDHAT RHSA-2017:3244
https://access.redhat.com/errata/RHSA-2017:2889
REDHAT RHSA-2017:2889
https://issues.apache.org/jira/browse/LOG4J2-1863 CONFIRM

- Metasploit Modules Related To CVE-2017-5645

There are not any metasploit modules related to this CVE entry (Please visit www.metasploit.com for more information)


CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.