CVE-2017-5645 In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events…

References

• RHSA-2017:2888 ↗ access.redhat.com
• RHSA-2017:2809 ↗ access.redhat.com
• 97702 ↗ www.securityfocus.com
• 1041294 ↗ www.securitytracker.com
• RHSA-2017:2810 ↗ access.redhat.com
• RHSA-2017:1801 ↗ access.redhat.com
• RHSA-2017:2889 ↗ access.redhat.com
• RHSA-2017:2635 ↗ access.redhat.com
• RHSA-2017:2638 ↗ access.redhat.com
• RHSA-2017:1417 ↗ access.redhat.com
• RHSA-2017:2423 ↗ access.redhat.com
• RHSA-2017:2808 ↗ access.redhat.com
• 1040200 ↗ www.securitytracker.com
• RHSA-2017:2636 ↗ access.redhat.com
• RHSA-2017:3399 ↗ access.redhat.com
• RHSA-2017:2637 ↗ access.redhat.com
• RHSA-2017:3244 ↗ access.redhat.com
• RHSA-2017:3400 ↗ access.redhat.com
• RHSA-2017:2633 ↗ access.redhat.com
• RHSA-2017:2811 ↗ access.redhat.com
• RHSA-2017:1802 ↗ access.redhat.com
• RHSA-2019:1545 ↗ access.redhat.com
• [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities ↗ lists.apache.org
• [logging-dev] 20191215 Re: Is there any chance that there will be a security fix for log4j-v1.2.17? ↗ lists.apache.org
• [logging-dev] 20191218 [CVE-2019-17571] Apache Log4j 1.2 deserialization of untrusted data in SocketServer ↗ lists.apache.org
• [oss-security] 20191218 [CVE-2019-17571] Apache Log4j 1.2 deserialization of untrusted data in SocketServer ↗ www.openwall.com
• [announce] 20191218 [CVE-2019-17571] Apache Log4j 1.2 deserialization of untrusted data in SocketServer ↗ lists.apache.org
• [logging-dev] 20191219 Re: [CVE-2019-17571] Apache Log4j 1.2 deserialization of untrusted data in SocketServer ↗ lists.apache.org
• [activemq-issues] 20191226 [jira] [Created] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 ↗ lists.apache.org
• [tika-dev] 20191226 [jira] [Created] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571 ↗ lists.apache.org
• [tika-dev] 20191226 [jira] [Commented] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571 ↗ lists.apache.org
• [tika-dev] 20191230 [jira] [Created] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] ↗ lists.apache.org
• [activemq-issues] 20191230 [jira] [Created] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10] ↗ lists.apache.org
• [tika-dev] 20200106 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] ↗ lists.apache.org
• [tika-dev] 20200107 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] ↗ lists.apache.org
• [tika-dev] 20200108 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] ↗ lists.apache.org
• [tika-dev] 20200110 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] ↗ lists.apache.org
• [tika-dev] 20200111 Re: [jira] [Commented] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571 ↗ lists.apache.org
• [tika-dev] 20200111 [jira] [Closed] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571 ↗ lists.apache.org
• [tika-dev] 20200111 [jira] [Resolved] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571 ↗ lists.apache.org
• [tika-dev] 20200114 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] ↗ lists.apache.org
• [tika-dev] 20200115 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] ↗ lists.apache.org
• [activemq-issues] 20200122 [jira] [Updated] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 ↗ lists.apache.org
• [activemq-issues] 20200122 [jira] [Assigned] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10] ↗ lists.apache.org
• [activemq-issues] 20200122 [jira] [Updated] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10] ↗ lists.apache.org
• [activemq-issues] 20200122 [jira] [Assigned] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 ↗ lists.apache.org
• [activemq-issues] 20200122 [jira] [Resolved] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10] ↗ lists.apache.org
• [activemq-issues] 20200127 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 ↗ lists.apache.org
• [activemq-issues] 20200208 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 ↗ lists.apache.org
• [activemq-issues] 20200228 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 ↗ lists.apache.org
• [activemq-issues] 20200228 [jira] [Resolved] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 ↗ lists.apache.org
• [activemq-issues] 20200228 [jira] [Updated] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 ↗ lists.apache.org
• [logging-commits] 20200425 svn commit: r1059809 - /websites/production/logging/content/log4j/2.13.2/security.html ↗ lists.apache.org
• www.oracle.com ↗ www.oracle.com
• www.oracle.com ↗ www.oracle.com
• www.oracle.com ↗ www.oracle.com
• www.oracle.com ↗ www.oracle.com
• www.oracle.com ↗ www.oracle.com
• www.oracle.com ↗ www.oracle.com
• www.oracle.com ↗ www.oracle.com
• www.oracle.com ↗ www.oracle.com
• www.oracle.com ↗ www.oracle.com
• www.oracle.com ↗ www.oracle.com
• www.oracle.com ↗ www.oracle.com
• security.netapp.com ↗ security.netapp.com
• security.netapp.com ↗ security.netapp.com
• issues.apache.org ↗ issues.apache.org
• [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image ↗ lists.apache.org
• [activemq-issues] 20200730 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 ↗ lists.apache.org
• [geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12 ↗ lists.apache.org
• www.oracle.com ↗ www.oracle.com
• www.oracle.com ↗ www.oracle.com
• [doris-commits] 20210402 [GitHub] [incubator-doris] zh0122 opened a new pull request #5594: [FE][Bug]Update log4j-web to fix a security issue ↗ lists.apache.org
• [beam-issues] 20210528 [jira] [Created] (BEAM-12422) Vendored gRPC 1.36.0 is using a log4j version with security issues ↗ lists.apache.org
• www.oracle.com ↗ www.oracle.com
• [beam-github] 20210701 [GitHub] [beam] lukecwik commented on pull request #15113: [BEAM-12422] Upgrade log4j version not affected by CVE-2017-5645 ↗ lists.apache.org
• [beam-github] 20210701 [GitHub] [beam] lukecwik opened a new pull request #15113: [BEAM-12422] Upgrade log4j version not affected by CVE-2017-5645 ↗ lists.apache.org
• [beam-github] 20210701 [GitHub] [beam] codecov[bot] commented on pull request #15113: [BEAM-12422] Upgrade log4j version not affected by CVE-2017-5645 ↗ lists.apache.org
• [beam-github] 20210701 [GitHub] [beam] codecov[bot] edited a comment on pull request #15113: [BEAM-12422] Upgrade log4j version not affected by CVE-2017-5645 ↗ lists.apache.org
• [beam-github] 20210701 [GitHub] [beam] suztomo commented on pull request #15113: [BEAM-12422] Upgrade log4j version not affected by CVE-2017-5645 ↗ lists.apache.org
• www.oracle.com ↗ www.oracle.com
• www.oracle.com ↗ www.oracle.com

Timeline

1. Published April 17, 2017
2. Last modified October 8, 2026