High ELSA-2017-2423 2 CVEs

Important: log4j security update (Oracle Linux 7)

Published Aug 9, 2017 · Updated Aug 9, 2017

Ecosystem: Oracle Linux

Summary

[0:1.2.17-16]
- Fix socket receiver deserialization vulnerability
- Resolves: CVE-2017-5645

Fixed packages 3

Release	Package	Fixed in
Oracle Linux · 7	log4j	0:1.2.17-16.el7_4
Oracle Linux · 7	log4j-javadoc	0:1.2.17-16.el7_4
Oracle Linux · 7	log4j-manual	0:1.2.17-16.el7_4

Vulnerabilities 2

Critical 9.8

CVE-2017-5645 Public exploit Scanner template EPSS 89%

Deserialization of Untrusted Data in Log4j

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Apache Software Foundation Apache Log4j apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven

Apr 17, 2017
Critical 9.8

CVE-2019-17571 Public exploit EPSS 70%

Deserialization of Untrusted Data in Log4j

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log dat…

Apache Software Foundation Log4j druid apache-log4j1.2 Debian Ubuntu Wolfi Maven

Dec 20, 2019