Tracker / CVE-2017-5645
CVE-2017-5645
Critical 9.8
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
Affected products and versions
| apache | log4j · 2.0 → 2.8.2 |
|---|---|
| netapp | oncommand_api_services |
| netapp | oncommand_insight |
| netapp | oncommand_workflow_automation |
| netapp | service_level_manager |
| netapp | snapcenter |
| netapp | storage_automation_store |
| oracle | api_gateway |
| oracle | application_testing_suite |
| oracle | autovue_vuelink_integration |
| oracle | banking_platform |
| oracle | bi_publisher |
| oracle | communications_converged_application_server_-_service_controller |
| oracle | communications_instant_messaging_server |
| oracle | communications_interactive_session_recorder · 6.0 → 6.2 |
| oracle | communications_messaging_server · … → 8.0.2 |
| oracle | communications_network_integrity · 7.3.2 → 7.3.6 |
| oracle | communications_online_mediation_controller |
| oracle | communications_pricing_design_center |
| oracle | communications_service_broker |
| oracle | communications_webrtc_session_controller · … → 7.2 |
| oracle | configuration_manager |
| oracle | endeca_information_discovery_studio |
| oracle | enterprise_data_quality |
| oracle | enterprise_manager_base_platform |
| oracle | enterprise_manager_for_fusion_middleware |
| oracle | enterprise_manager_for_mysql_database · … → 13.2.2.0.0 |
| oracle | enterprise_manager_for_oracle_database |
| oracle | enterprise_manager_for_peoplesoft |
| oracle | financial_services_analytical_applications_infrastructure · 7.3.3.0.0 → 7.3.3.0.2 |
| oracle | financial_services_analytical_applications_infrastructure · 8.0.0.0.0 → 8.0.7.0.0 |
| oracle | financial_services_behavior_detection_platform |
| oracle | financial_services_behavior_detection_platform · 8.0.0.0.0 → 8.0.4.0.0 |
| oracle | financial_services_hedge_management_and_ifrs_valuations |
| oracle | financial_services_lending_and_leasing |
| oracle | financial_services_lending_and_leasing · 14.1.0 → 14.8.0 |
| oracle | financial_services_loan_loss_forecasting_and_provisioning |
| oracle | financial_services_profitability_management |
| oracle | financial_services_profitability_management · 8.0.0.0.0 → 8.0.7.0.0 |
| oracle | financial_services_regulatory_reporting_with_agilereporter |
| oracle | flexcube_investor_servicing |
| oracle | fusion_middleware_mapviewer |
| oracle | goldengate |
| oracle | goldengate_application_adapters |
| oracle | identity_analytics |
| oracle | identity_management_suite |
| oracle | identity_manager_connector |
| oracle | in-memory_performance-driven_planning |
| oracle | instantis_enterprisetrack · 17.1 → 17.3 |
| oracle | insurance_calculation_engine |
| oracle | insurance_policy_administration |
| oracle | insurance_rules_palette |
| oracle | jd_edwards_enterpriseone_tools |
| oracle | jdeveloper |
| oracle | mysql_enterprise_monitor · 3.4.0.0 → 3.4.7.4297 |
| oracle | mysql_enterprise_monitor · 4.0.0.0 → 4.0.4.5235 |
| oracle | mysql_enterprise_monitor · 8.0.0.0.0 → 8.0.0.8131 |
| oracle | peoplesoft_enterprise_fin_install |
| oracle | policy_automation |
| oracle | policy_automation_connector_for_siebel |
Analysis
This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.