Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZ4cGgtcTNqOC1tdjg3

Deserialization of Untrusted Data in Log4j

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Permalink: https://github.com/advisories/GHSA-fxph-q3j8-mv87
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZ4cGgtcTNqOC1tdjg3
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 4 years ago
Updated: about 1 year ago


CVSS Score: 9.8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-fxph-q3j8-mv87, CVE-2017-5645
References: Blast Radius: 48.2

Affected Packages

maven:org.apache.logging.log4j:log4j-core
Dependent packages: 8,839
Dependent repositories: 82,953
Downloads:
Affected Version Ranges: >= 2.0, < 2.8.2
Fixed in: 2.8.2
All affected versions: 2.0.1, 2.0.2, 2.3.1, 2.3.2, 2.4.1, 2.6.1, 2.6.2, 2.8.1
All unaffected versions: 2.8.2, 2.9.0, 2.9.1, 2.10.0, 2.11.0, 2.11.1, 2.11.2, 2.12.0, 2.12.1, 2.12.2, 2.12.3, 2.12.4, 2.13.0, 2.13.1, 2.13.2, 2.13.3, 2.14.0, 2.14.1, 2.15.0, 2.16.0, 2.17.0, 2.17.1, 2.17.2, 2.18.0, 2.19.0, 2.20.0, 2.21.0, 2.21.1, 2.22.0, 2.22.1, 2.23.0, 2.23.1
maven:org.apache.logging.log4j:log4j
Dependent packages: 64
Dependent repositories: 665
Downloads:
Affected Version Ranges: >= 2.0, < 2.8.2
Fixed in: 2.8.2
All affected versions: 2.0.1, 2.0.2, 2.3.1, 2.3.2, 2.4.1, 2.6.1, 2.6.2, 2.8.1
All unaffected versions: 2.8.2, 2.9.0, 2.9.1, 2.10.0, 2.11.0, 2.11.1, 2.11.2, 2.12.0, 2.12.1, 2.12.2, 2.12.3, 2.12.4, 2.13.0, 2.13.1, 2.13.2, 2.13.3, 2.14.0, 2.14.1, 2.15.0, 2.16.0, 2.17.0, 2.17.1, 2.17.2, 2.18.0, 2.19.0, 2.20.0, 2.21.0, 2.21.1, 2.22.0, 2.22.1, 2.23.0, 2.23.1