NetSight
IP …
critical9.8

CVE-2019-17571

Deserialization of Untrusted Data in Log4j

Impact

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions 1.2 up to 1.2.17. Users are advised to migrate to `org.apache.logging.log4j:log4j-core`.

Affected packages

EcosystemPackageAffectedFixed in
mavenlog4j:log4j>= 1.2, <= 1.2.17none recorded
mavenorg.zenframework.z8.dependencies.commons:log4j-1.2.17= 2.0none recorded

Affected products

VendorProductAffected versions
ApacheLog4j
through 1.2.17
DebianDebian Linux
Versions 8.0, 9.0, 10.0
CanonicalUbuntu Linux
Version 18.04
OpensuseLeap
Version 15.1
NetappOncommand System Manager
from 3.0 through 3.1.3
NetappOncommand Workflow Automation
All versions
OracleApplication Testing Suite
Version 13.3.0.1
OracleCommunications Network Integrity
from 7.3.2 through 7.3.6
OracleEndeca Information Discovery Studio
Version 3.2.0
OracleFinancial Services Lending And Leasing
from 14.1.0 through 14.8.0
Version 12.5.0
OracleMysql Enterprise Monitor
through 8.0.29
OraclePrimavera Gateway
from 16.2 through 16.2.11
from 17.12.0 through 17.12.7

Weakness classification

CWE-502

References