CVE-2017-5645

CRITICAL9.8EPSS 94.0%

Deserialization of Untrusted Data in Log4j

Published: 1/6/2020Modified: 3/14/2024
Also known as:GHSA-fxph-q3j8-mv87DEBIAN-CVE-2017-5645

Description

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Affected packages (3)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1CRITICAL9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (85)