CVE-2019-17571
Deserialization of Untrusted Data in Log4j
Description
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions 1.2 up to 1.2.17.
Users are advised to migrate to org.apache.logging.log4j:log4j-core.
Base CVSS
9.8
EPSS Score
48.46%
Introduced Version
1.2,1.2.4,2.0-rc2,2.7
Fix Available
2.8.2
Available Patches
Package
CVEs Fixed
Lines of Code Changed