CVE-2017-5645

CRITICAL9.8Insecure deserialization

Public PoCHigh EPSS

Description

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected products

apache / log4j2.0 – 2.8.2
Apache Software Foundation / Apache Log4jAll versions between 2.0-alpha1 and 2.8.1 – All versions between 2.0-alpha1 and 2.8.1
NetApp / oncommand_api_services
NetApp / OnCommand Insight
NetApp / OnCommand Workflow Automation
NetApp / service_level_manager
NetApp / SnapCenter
NetApp / storage_automation_store
oracle / api_gateway11.1.2.4.0 – 11.1.2.4.0
oracle / Application Testing Suite13.3.0.1 – 13.3.0.1
oracle / autovue_vuelink_integration21.0.0 – 21.0.0
oracle / autovue_vuelink_integration21.0.1 – 21.0.1
oracle / banking_platform2.6.2 – 2.6.2
oracle / banking_platform2.6.1 – 2.6.1
oracle / banking_platform2.6.0 – 2.6.0
oracle / bi_publisher11.1.1.7.0 – 11.1.1.7.0
oracle / bi_publisher12.2.1.4.0 – 12.2.1.4.0
oracle / bi_publisher12.2.1.3.0 – 12.2.1.3.0
oracle / bi_publisher11.1.1.9.0 – 11.1.1.9.0
oracle / communications_converged_application_server_-_service_controller6.1 – 6.1
oracle / communications_instant_messaging_server10.0.1.3.0 – 10.0.1.3.0
oracle / communications_interactive_session_recorder6.0 – 6.2
oracle / communications_messaging_server8.0.2
oracle / communications_network_integrity7.3.2 – 7.3.6
oracle / communications_online_mediation_controller6.1 – 6.1
oracle / communications_pricing_design_center11.1 – 11.1
oracle / communications_pricing_design_center12.0 – 12.0
oracle / communications_service_broker6.0 – 6.0
oracle / communications_webrtc_session_controller7.2
oracle / configuration_manager12.1.2.0.2 – 12.1.2.0.2
oracle / configuration_manager12.1.2.0.5 – 12.1.2.0.5
oracle / endeca_information_discovery_studio3.2.0 – 3.2.0
oracle / enterprise_data_quality12.2.1.3.0 – 12.2.1.3.0
oracle / enterprise_manager_base_platform12.1.0.5 – 12.1.0.5
oracle / enterprise_manager_base_platform13.2.0.0 – 13.2.0.0
oracle / enterprise_manager_for_fusion_middleware12.1.0.5 – 12.1.0.5
oracle / enterprise_manager_for_fusion_middleware13.2.0.0 – 13.2.0.0
oracle / enterprise_manager_for_mysql_database13.2.2.0.0
oracle / enterprise_manager_for_oracle_database12.1.0.8 – 12.1.0.8
oracle / enterprise_manager_for_oracle_database13.2.2 – 13.2.2
oracle / enterprise_manager_for_peoplesoft13.1.1.1 – 13.1.1.1
oracle / enterprise_manager_for_peoplesoft13.2.1.1 – 13.2.1.1
oracle / financial_services_analytical_applications_infrastructure7.3.3.0.0 – 7.3.3.0.2
oracle / financial_services_behavior_detection_platform6.1.1 – 6.1.1
oracle / financial_services_behavior_detection_platform8.0.0.0.0 – 8.0.4.0.0
oracle / financial_services_hedge_management_and_ifrs_valuations8.0.5 – 8.0.5
oracle / financial_services_hedge_management_and_ifrs_valuations8.0.4 – 8.0.4
oracle / financial_services_lending_and_leasing14.1.0 – 14.8.0
oracle / financial_services_lending_and_leasing12.5.0 – 12.5.0
oracle / financial_services_loan_loss_forecasting_and_provisioning8.0.4 – 8.0.4
oracle / financial_services_loan_loss_forecasting_and_provisioning8.0.5 – 8.0.5
oracle / financial_services_profitability_management8.0.0.0.0 – 8.0.7.0.0
oracle / financial_services_profitability_management6.1.1 – 6.1.1
oracle / financial_services_regulatory_reporting_with_agilereporter8.0.9.2.0 – 8.0.9.2.0
oracle / FLEXCUBE Investor Servicing14.0.0 – 14.0.0
oracle / FLEXCUBE Investor Servicing12.0.4 – 12.0.4
oracle / FLEXCUBE Investor Servicing12.1.0 – 12.1.0
oracle / FLEXCUBE Investor Servicing12.3.0 – 12.3.0
oracle / FLEXCUBE Investor Servicing12.4.0 – 12.4.0
oracle / fusion_middleware_mapviewer12.2.1.2 – 12.2.1.2
oracle / fusion_middleware_mapviewer12.2.1.3 – 12.2.1.3
oracle / goldengate12.3.2.1.1 – 12.3.2.1.1
oracle / goldengate_application_adapters12.3.2.1.1 – 12.3.2.1.1
oracle / identity_analytics11.1.1.5.8 – 11.1.1.5.8
oracle / identity_management_suite12.2.1.3.0 – 12.2.1.3.0
oracle / identity_management_suite11.1.2.3.0 – 11.1.2.3.0
oracle / identity_manager_connector9.0 – 9.0
oracle / in-memory_performance-driven_planning12.1 – 12.1
oracle / in-memory_performance-driven_planning12.2 – 12.2
oracle / instantis_enterprisetrack17.1 – 17.3
oracle / insurance_calculation_engine10.1.1 – 10.1.1
oracle / insurance_calculation_engine10.2.1 – 10.2.1
oracle / insurance_policy_administration11.0 – 11.0
oracle / insurance_policy_administration10.2 – 10.2
oracle / insurance_policy_administration10.1 – 10.1
oracle / insurance_policy_administration10.0 – 10.0
oracle / insurance_rules_palette10.0 – 10.0
oracle / insurance_rules_palette11.1 – 11.1
oracle / insurance_rules_palette11.0 – 11.0
oracle / insurance_rules_palette10.2 – 10.2
oracle / insurance_rules_palette10.1 – 10.1
oracle / jd_edwards_enterpriseone_tools9.2 – 9.2
oracle / jd_edwards_enterpriseone_tools4.0.1.0 – 4.0.1.0
oracle / JDeveloper12.2.1.3.0 – 12.2.1.3.0
oracle / JDeveloper11.1.1.9.0 – 11.1.1.9.0
oracle / JDeveloper12.1.3.0.0 – 12.1.3.0.0
oracle / MySQL Enterprise Monitor3.4.0.0 – 3.4.7.4297
oracle / peoplesoft_enterprise_fin_install9.2 – 9.2
oracle / policy_automation12.1.0 – 12.1.0
oracle / policy_automation12.2.0 – 12.2.0
oracle / policy_automation12.2.1 – 12.2.1
oracle / policy_automation12.2.2 – 12.2.2
oracle / policy_automation12.2.3 – 12.2.3
oracle / policy_automation12.2.4 – 12.2.4
oracle / policy_automation12.2.5 – 12.2.5
oracle / policy_automation12.2.6 – 12.2.6
oracle / policy_automation12.2.7 – 12.2.7
oracle / policy_automation12.2.8 – 12.2.8
oracle / policy_automation12.2.9 – 12.2.9
oracle / policy_automation12.2.10 – 12.2.10
oracle / policy_automation12.1.1 – 12.1.1
oracle / policy_automation10.4.7 – 10.4.7
oracle / policy_automation_connector_for_siebel10.4.6 – 10.4.6
oracle / policy_automation_for_mobile_devices10.4.7 – 10.4.7
oracle / policy_automation_for_mobile_devices12.1.0 – 12.1.0
oracle / policy_automation_for_mobile_devices12.1.1 – 12.1.1
oracle / policy_automation_for_mobile_devices12.2.0 – 12.2.0
oracle / policy_automation_for_mobile_devices12.2.1 – 12.2.1
oracle / policy_automation_for_mobile_devices12.2.2 – 12.2.2
oracle / policy_automation_for_mobile_devices12.2.3 – 12.2.3
oracle / policy_automation_for_mobile_devices12.2.4 – 12.2.4
oracle / policy_automation_for_mobile_devices12.2.5 – 12.2.5
oracle / policy_automation_for_mobile_devices12.2.6 – 12.2.6
oracle / policy_automation_for_mobile_devices12.2.7 – 12.2.7
oracle / policy_automation_for_mobile_devices12.2.8 – 12.2.8
oracle / policy_automation_for_mobile_devices12.2.9 – 12.2.9
oracle / policy_automation_for_mobile_devices12.2.10 – 12.2.10
oracle / primavera_gateway16.2.0 – 16.2.11
oracle / rapid_planning12.1 – 12.1
oracle / rapid_planning12.2 – 12.2
oracle / retail_advanced_inventory_planning15.0 – 15.0
oracle / retail_advanced_inventory_planning14.0 – 14.0
oracle / retail_clearance_optimization_engine14.0.5 – 14.0.5
oracle / retail_extract_transform_and_load19.0 – 19.0
oracle / retail_extract_transform_and_load13.0 – 13.0
oracle / retail_extract_transform_and_load13.1 – 13.1
oracle / retail_extract_transform_and_load13.2 – 13.2
oracle / retail_integration_bus14.0.0 – 14.0.0
oracle / retail_integration_bus14.1.0 – 14.1.0
oracle / retail_integration_bus15.0 – 15.0
oracle / retail_integration_bus16.0 – 16.0
oracle / retail_open_commerce_platform6.0.1 – 6.0.1
oracle / retail_open_commerce_platform5.3.0 – 5.3.0
oracle / retail_open_commerce_platform6.0.0 – 6.0.0
oracle / retail_predictive_application_server15.0.3 – 15.0.3
oracle / retail_service_backbone14.1 – 14.1
oracle / retail_service_backbone16.0 – 16.0
oracle / retail_service_backbone15.0 – 15.0
oracle / Siebel UI Framework18.9 – 18.9
oracle / Siebel UI Framework18.7 – 18.7
oracle / Siebel UI Framework18.8 – 18.8
oracle / soa_suite12.2.1.3.0 – 12.2.1.3.0
oracle / soa_suite12.1.3.0.0 – 12.1.3.0.0
oracle / soa_suite12.2.2.0.0 – 12.2.2.0.0
oracle / tape_library_acsls8.4 – 8.4
oracle / timesten_in-memory_database11.2.2.8.49 – 11.2.2.8.49
oracle / utilities_advanced_spatial_and_operational_analytics2.7.0.1 – 2.7.0.1
oracle / utilities_work_and_asset_management1.9.1.2.12 – 1.9.1.2.12
oracle / weblogic_server12.2.1.4.0 – 12.2.1.4.0
oracle / weblogic_server14.1.1.0.0 – 14.1.1.0.0
oracle / weblogic_server12.2.1.3.0 – 12.2.1.3.0
oracle / weblogic_server12.1.3.0.0 – 12.1.3.0.0
oracle / weblogic_server10.3.6.0.0 – 10.3.6.0.0
RedHat / enterprise_linux6.0 – 6.0
RedHat / enterprise_linux6.7 – 6.7
RedHat / enterprise_linux7.0 – 7.0
RedHat / enterprise_linux7.3 – 7.3
RedHat / enterprise_linux7.4 – 7.4
RedHat / enterprise_linux7.5 – 7.5
RedHat / enterprise_linux7.6 – 7.6
RedHat / enterprise_linux_desktop7.0 – 7.0
RedHat / enterprise_linux_server7.0 – 7.0
RedHat / enterprise_linux_server_aus7.6 – 7.6
RedHat / enterprise_linux_server_aus7.4 – 7.4
RedHat / enterprise_linux_server_eus7.6 – 7.6
RedHat / enterprise_linux_server_eus7.5 – 7.5
RedHat / enterprise_linux_server_eus7.4 – 7.4
RedHat / enterprise_linux_server_tus7.6 – 7.6
RedHat / enterprise_linux_server_tus7.4 – 7.4
RedHat / enterprise_linux_workstation7.0 – 7.0
RedHat / fuse1.0 – 1.0

Exploits & proofs of concept

nucleiApache Log4j Server - Deserialization Command Executionby princechaddha

References

Updated 23m ago · 8 sources