CVE-2017-5645

Aliases:GHSA-fxph-q3j8-mv87
Advisory lineage Upstream: 0 Downstream: 13
Modified
Published: 17 Apr 2017, 21:00
Last modified:05 Aug 2024, 15:11

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (nvd)
EPSS Score
94.01% CRITICAL
94% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

17 Apr 2017, 21:00
Published
Vulnerability first disclosed
05 Aug 2024, 15:11
Last Modified
Vulnerability information updated

Description

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v3.0•CRITICAL•Score: 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 94.01%• Percentile: 100%

Techniques & Countermeasures

  • CWE-502•Deserialization of Untrusted Data

    The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected Systems

  • apache software foundation•apache log4j

    All versions between 2.0-alpha1 and 2.8.1

  • apache•log4j

    ≥ 2.0, < 2.8.2

  • org.apache.logging.log4j•log4j

    ≥ 2.0, < 2.8.2

  • org.apache.logging.log4j•log4j-core

    ≥ 2.0, < 2.8.2

  • netapp•oncommand_api_services

    na

  • netapp•oncommand_insight

    na

  • netapp•oncommand_workflow_automation

    na

  • netapp•service_level_manager

    na

  • netapp•snapcenter

    na

  • netapp•storage_automation_store

    na

  • oracle•api_gateway

    11.1.2.4.0

  • oracle•application_testing_suite

    13.3.0.1

  • oracle•autovue_vuelink_integration

    21.0.0 | 21.0.1

  • oracle•banking_platform

    2.6.0 | 2.6.1 | 2.6.2

  • oracle•bi_publisher

    11.1.1.7.0 | 11.1.1.9.0 | 12.2.1.3.0 | 12.2.1.4.0

  • oracle•communications_converged_application_server_-_service_controller

    6.1

  • oracle•communications_instant_messaging_server

    10.0.1.3.0

  • oracle•communications_interactive_session_recorder

    ≥ 6.0, ≤ 6.2

  • oracle•communications_messaging_server

    < 8.0.2

  • oracle•communications_network_integrity

    ≥ 7.3.2, ≤ 7.3.6

  • oracle•communications_online_mediation_controller

    6.1

  • oracle•communications_pricing_design_center

    11.1 | 12.0

  • oracle•communications_service_broker

    6.0

  • oracle•communications_webrtc_session_controller

    < 7.2

  • oracle•configuration_manager

    12.1.2.0.2 | 12.1.2.0.5

  • oracle•endeca_information_discovery_studio

    3.2.0

  • oracle•enterprise_data_quality

    12.2.1.3.0

  • oracle•enterprise_manager_base_platform

    12.1.0.5 | 13.2.0.0

  • oracle•enterprise_manager_for_fusion_middleware

    12.1.0.5 | 13.2.0.0

  • oracle•enterprise_manager_for_mysql_database

    ≤ 13.2.2.0.0

  • oracle•enterprise_manager_for_oracle_database

    12.1.0.8 | 13.2.2

  • oracle•enterprise_manager_for_peoplesoft

    13.1.1.1 | 13.2.1.1

  • oracle•financial_services_analytical_applications_infrastructure

    ≥ 7.3.3.0.0, ≤ 7.3.3.0.2 | ≥ 8.0.0.0.0, ≤ 8.0.7.0.0

  • oracle•financial_services_behavior_detection_platform

    ≥ 8.0.0.0.0, ≤ 8.0.4.0.0 | 6.1.1

  • oracle•financial_services_hedge_management_and_ifrs_valuations

    8.0.4 | 8.0.5

  • oracle•financial_services_lending_and_leasing

    ≥ 14.1.0, ≤ 14.8.0 | 12.5.0

  • oracle•financial_services_loan_loss_forecasting_and_provisioning

    8.0.4 | 8.0.5

  • oracle•financial_services_profitability_management

    ≥ 8.0.0.0.0, ≤ 8.0.7.0.0 | 6.1.1

  • oracle•financial_services_regulatory_reporting_with_agilereporter

    8.0.9.2.0

  • oracle•flexcube_investor_servicing

    12.0.4 | 12.1.0 | 12.3.0 | 12.4.0 | 14.0.0

  • oracle•fusion_middleware_mapviewer

    12.2.1.2 | 12.2.1.3

  • oracle•goldengate

    12.3.2.1.1

  • oracle•goldengate_application_adapters

    12.3.2.1.1

  • oracle•identity_analytics

    11.1.1.5.8

  • oracle•identity_management_suite

    11.1.2.3.0 | 12.2.1.3.0

  • oracle•identity_manager_connector

    9.0

  • oracle•in-memory_performance-driven_planning

    12.1 | 12.2

  • oracle•instantis_enterprisetrack

    ≥ 17.1, ≤ 17.3

  • oracle•insurance_calculation_engine

    10.1.1 | 10.2.1

  • oracle•insurance_policy_administration

    10.0 | 10.1 | 10.2 | 11.0

Showing first 50 affected entries in server-rendered view.

References (126)