CVE-2017-5645

תיאור (מקור, אנגלית)

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

מדדים

CVSS 3.1

9.8 (CRITICAL) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-502

מוצרים מושפעים

apache: log4j; netapp: oncommand api services; netapp: oncommand insight; netapp: oncommand workflow automation; netapp: service level manager; netapp: snapcenter; netapp: storage automation store; redhat: fuse; redhat: enterprise linux; redhat: enterprise linux desktop; redhat: enterprise linux server; redhat: enterprise linux server aus; redhat: enterprise linux server eus; redhat: enterprise linux server tus; redhat: enterprise linux workstation

קישורים

• https://issues.apache.org/jira/browse/LOG4J2-1863 Issue TrackingVendor Advisory
• https://issues.apache.org/jira/browse/LOG4J2-1863 Issue TrackingVendor Advisory
• http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html Patch
• http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html Patch
• http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html Patch
• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html PatchThird Party Advisory
• https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html PatchThird Party Advisory
• https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html PatchThird Party Advisory
• https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html PatchThird Party Advisory
• https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html PatchThird Party Advisory