Skip to content
OpenAdvisories
Critical DSA-4686-1 1 CVE

apache-log4j1.2 - security update

Published May 16, 2020 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

ReleasePackageFixed in
Debian · 10 apache-log4j1.2 1.2.17-8+deb10u1
Debian · 9 apache-log4j1.2 1.2.17-7+deb9u1

Vulnerabilities 1

  • Critical 9.8
    CVE-2019-17571 Public exploit EPSS 70%

    Deserialization of Untrusted Data in Log4j

    Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log dat…

    Apache Software Foundation Log4j druid apache-log4j1.2 Debian Ubuntu Wolfi Maven