CVE-2017-5645
Description
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
Risk Information
Base Score
9.8
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
94.013
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Multiple vulnerabilities are affected in Oracle WebLogic Server 10.3.6.0.0 | Windows |
| Multiple vulnerabilities are affected in Oracle WebLogic Server 12.1.3.0.0 | Windows |
| Multiple vulnerabilities are affected in Oracle WebLogic Server 12.2.1.3 | Windows |
| Multiple vulnerabilities are affected in Oracle WebLogic Server 12.1.3.0 | Windows |
| Multiple vulnerabilities are affected in Oracle WebLogic Server 12.2.1.3.0 | Windows |
| Vulnerabilities CVE-2017-5645,CVE-2018-2625 are affected in Oracle WebLogic Server 12.2.1.2.0 | Windows |
| Multiple vulnerabilities are affected in Oracle WebLogic Server 12.2.1.4.0 | Windows |
| Multiple vulnerabilities are affected in Oracle WebLogic Server 14.1.1.0.0 | Windows |
| Multiple vulnerabilities are affected in Oracle WebLogic Server 10.3.6.0 | Windows |
| Multiple vulnerabilities are affected in Oracle WebLogic Server 12.2.1.2 | Windows |
| Vulnerabilities CVE-2017-5645 are fixed in Apache-log4j 2.8.2 | Windows |
| Multiple vulnerabilities are affected in Oracle WebLogic Server 12.2.1.2.0 | Windows |
| Vulnerabilities CVE-2017-5645 are fixed in Apache - Log4j Core 2.8.2 | Windows |
| Multiple Vulnerabilities are affected in Netapp Snapcenter - | Windows |
| Multiple Vulnerabilities are affected in Netapp Oncommand Workflow Automation - | Windows |
| Multiple Vulnerabilities are affected in Netapp Oncommand Insight - | Windows |
| Multiple vulnerabilities are affected in Oracle BI Publisher 11.1.1.9.0 | Windows |
| Vulnerabilities CVE-2016-3432,CVE-2016-3473,CVE-2016-3474,CVE-2017-5645 are affected in Oracle BI Publisher 11.1.1.7.0 | Windows |
| Multiple vulnerabilities are affected in Oracle BI Publisher 12.2.1.3.0 | Windows |
| Multiple vulnerabilities are affected in Oracle BI Publisher 12.2.1.4.0 | Windows |
| Multiple Vulnerabilities are affected in JD Edwards EnterpriseOne Tools 9.2 | Windows |
| Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 6.1.0.3 | Windows |
| Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 6.0.3.4 | Windows |
| (RHSA-2017:2423) Important: log4j security update log4j-1.2.17-16.el7_4.noarch.rpm | Linux |
| (RHSA-2017:2423) Important: log4j security update log4j-javadoc-1.2.17-16.el7_4.noarch.rpm | Linux |
| (RHSA-2017:2423) Important: log4j security update log4j-manual-1.2.17-16.el7_4.noarch.rpm | Linux |
| Log4j update (ELSA-2017-2423) log4j-1.2.17-16.el7_4.noarch.rpm | Linux |
| Log4j-javadoc update (ELSA-2017-2423) log4j-javadoc-1.2.17-16.el7_4.noarch.rpm | Linux |
| Log4j-manual update (ELSA-2017-2423) log4j-manual-1.2.17-16.el7_4.noarch.rpm | Linux |
| (CESA-2017:2423) Important: log4j security update log4j-1.2.17-16.el7_4.noarch.rpm | Linux |
| (CESA-2017:2423) Important: log4j security update log4j-javadoc-1.2.17-16.el7_4.noarch.rpm | Linux |
| (CESA-2017:2423) Important: log4j security update log4j-manual-1.2.17-16.el7_4.noarch.rpm | Linux |
| Vulnerabilities CVE-2017-5645 are fixed in Apache-log4j for Linux 2.8.2 | Linux |
| Vulnerabilities CVE-2017-5645 are fixed in Apache - Log4j Core for Linux 2.8.2 | Linux |
| Deserialization of Untrusted Data Vulnerability (CVE-2017-5645) | NCM |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234