9.8crit
CVE-2017-5645in critical feed
Deserialization of Untrusted Data in Log4j
Also known as GHSA-fxph-q3j8-mv87
Published 9 y ago · modified 29 d ago · JSON
CVSS
9.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
89.4%
percentile 100%
Public exploits
0
none known
Summary
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 29 d ago
Exploit prediction (EPSS)
89.36% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.logging.log4j:log4j | >=2.0, <2.8.2 | 2.8.2 |
| maven | org.apache.logging.log4j:log4j-core | >=2.0, <2.8.2 | 2.8.2 |
Affected products
- Apache Software Foundation Apache Log4j
Classification
- Weakness
- CWE-502 Deserialization of Untrusted Data
- Technology feeds
- Log4j (RSS, critical only)
References
- access.redhat.com /errata/RHSA-2017:2888 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2017:2809 · vendor-advisory, x_refsource_REDHAT, x_transferred
- securityfocus.com /bid/97702 · vdb-entry, x_refsource_BID, x_transferred
- securitytracker.com /id/1041294 · vdb-entry, x_refsource_SECTRACK, x_transferred
- access.redhat.com /errata/RHSA-2017:2810 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2017:1801 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2017:2889 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2017:2635 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2017:2638 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2017:1417 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2017:2423 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2017:2808 · vendor-advisory, x_refsource_REDHAT, x_transferred
- securitytracker.com /id/1040200 · vdb-entry, x_refsource_SECTRACK, x_transferred
- access.redhat.com /errata/RHSA-2017:2636 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2017:3399 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2017:2637 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2017:3244 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2017:3400 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2017:2633 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2017:2811 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2017:1802 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2019:1545 · vendor-advisory, x_refsource_REDHAT, x_transferred
- lists.apache.org /thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.a · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/e8fb7d76a244ee997ba4b217d6171227f7c2521af8c7c5b16cba27bc%40%3Cdev.logging.apa · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apa · mailing-list, x_refsource_MLIST, x_transferred
- openwall.com /lists/oss-security/2019/12/19/2 · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/84cc4266238e057b95eb95dfd8b29d46a2592e7672c12c92f68b2917%40%3Cannounce.apache · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/0dcca05274d20ef2d72584edcf8c917bbb13dbbd7eb35cae909d02e9%40%3Cdev.logging.apa · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac%40%3Cissues.activemq · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c%40%3Cdev.tika.apache · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1%40%3Cdev.tika.apache · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6%40%3Cdev.tika.apache · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c%40%3Cissues.activemq · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f%40%3Cdev.tika.apach · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8%40%3Cdev.tika.apach · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7%40%3Cdev.tika.apach · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1%40%3Cdev.tika.apach · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60%40%3Cdev.tika.apach · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5%40%3Cdev.tika.apach · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26%40%3Cdev.tika.apach · mailing-list, x_refsource_MLIST, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2017-5645 · advisory
- oracle.com /technetwork/security-advisory/cpuoct2019-5072832.html · web
- lists.apache.org /thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e@%3Cissues.activemq. · web
- lists.apache.org /thread.html/rcbb79023a7c8494cb389cd3d95420fa9e0d531ece0b780b8c1f99422@%3Ccommits.doris.ap · web
- lists.apache.org /thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2@%3Cdev.tika.apache. · web
- lists.apache.org /thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7@%3Cdev.tika.apache. · web
- lists.apache.org /thread.html/rbfa7a0742be4981a3f9356a23d0e1a5f2e1eabde32a1a3d8e41420f8@%3Cgithub.beam.apac · web
- lists.apache.org /thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf@%3Cissues.activemq. · web
- lists.apache.org /thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead@%3Cissues.activemq. · web
- lists.apache.org /thread.html/ra9a682bc0a8dff1c5cefdef31c7c25f096d9121207cf2d74e2fc563d@%3Ccommits.logging. · web
- lists.apache.org /thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60@%3Cdev.tika.apache. · web
- lists.apache.org /thread.html/r9d5c1b558a15d374bd5abd2d3ae3ca7e50e796a0efdcf91e9c5b4cdd@%3Cgithub.beam.apac · web
- lists.apache.org /thread.html/r94b5aae09c4bcff5d06cf641be17b00bd83ba7e10cad737bf16a1b8f@%3Cgithub.beam.apac · web
- lists.apache.org /thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826@%3Cissues.activemq. · web
- lists.apache.org /thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5@%3Cdev.tika.apache. · web
- lists.apache.org /thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1@%3Cdev.tika.apache. · web
- lists.apache.org /thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78@%3Cissues.activemq. · web
- lists.apache.org /thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad@%3Cdev.tika.apache. · web
- lists.apache.org /thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919@%3Cissues.activemq. · web
- lists.apache.org /thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8@%3Cdev.tika.apache. · web
Sources
- CVE List: CVE-2017-5645
- GitHub Advisory: GHSA-fxph-q3j8-mv87
- NVD: CVE-2017-5645
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.