Back

CRITICAL

log4j: Socket receiver deserialization vulnerability

Published Apr 17, 2017

Description

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Affected products

Remediation

Red Hat statement

The flaw in Log4j-1.x is now identified by CVE-2019-17571. CVE-2017-5645 has been assigned by MITRE to a similar flaw identified in Log4j-2.x

Metrics

References (127)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner apache
Published Apr 17, 2017
Updated Aug 5, 2024
Reserved Jan 29, 2017
NVD
Status Modified
Modified Jun 17, 2026
Red Hat
Severity Important
Public date Apr 2, 2017
GHSA-FXPH-Q3J8-MV87