Skip to content
fr Sign in
9.8 Critical

CVE-2019-17571 Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be…

Description

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

Affected products and versions

Product Affected versions Fixed in
Log4j Versions not published

References

Timeline

  1. Published
  2. Last modified
Track this CVE