CVE-2017-5645
Deserialization of Untrusted Data in Log4j
Description
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
Base CVSS
9.8
EPSS Score
94.01%
Introduced Version
2.0-rc2,2.7
Fix Available
2.8.2
Available Patches
Package
CVEs Fixed
Lines of Code Changed