CVE-2019-17571
CRITICAL
9.8
CVSS Severity Score
Vulnerability Description
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
Affected Platforms (CPE)
📦
Apache
Log4j
<= 1.2.17💻
Debian
Debian Linux
= 8.0💻
Debian
Debian Linux
= 9.0💻
Debian
Debian Linux
= 10.0💻
Canonical
Ubuntu Linux
= 18.04💻
Opensuse
Leap
= 15.1📦
Netapp
Oncommand System Manager
>= 3.0 and <= 3.1.3📦
Netapp
Oncommand Workflow Automation
All versions📦
Oracle
Application Testing Suite
= 13.3.0.1📦
Oracle
Communications Network Integrity
>= 7.3.2 and <= 7.3.6📦
Oracle
Endeca Information Discovery Studio
= 3.2.0📦
Oracle
Financial Services Lending And Leasing
>= 14.1.0 and <= 14.8.0📦
Oracle
Financial Services Lending And Leasing
= 12.5.0📦
Oracle
Mysql Enterprise Monitor
<= 8.0.29📦
Oracle
Primavera Gateway
>= 16.2 and <= 16.2.11📦
Oracle
Primavera Gateway
>= 17.12.0 and <= 17.12.7📦
Oracle
Rapid Planning
= 12.1📦
Oracle
Rapid Planning
= 12.2📦
Oracle
Retail Extract Transform And Load
= 19.0📦
Oracle
Retail Service Backbone
= 14.1📦
Oracle
Retail Service Backbone
= 15.0📦
Oracle
Retail Service Backbone
= 16.0📦
Oracle
Weblogic Server
= 10.3.6.0.0📦
Oracle
Weblogic Server
= 12.1.3.0.0📦
Oracle
Weblogic Server
= 12.2.1.3.0📦
Oracle
Weblogic Server
= 12.2.1.4.0📦
Oracle
Weblogic Server
= 14.1.1.0.0📦
Apache