Skip to content
OpenAdvisories
Critical USN-4495-1 1 CVE

Apache Log4j vulnerability

Published Sep 15, 2020 · Updated May 29, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Apache Log4j does not properly deserialize
untrusted data. An attacker could possibly use this issue to remotely
execute arbitrary code. (CVE-2019-17571)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS apache-log4j1.2 1.2.17-8+deb10u1build0.18.04.1

Vulnerabilities 1

  • Critical 9.8
    CVE-2019-17571 Public exploit EPSS 70%

    Deserialization of Untrusted Data in Log4j

    Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log dat…

    Apache Software Foundation Log4j druid apache-log4j1.2 Debian Ubuntu Wolfi Maven

References

  • report
    https://ubuntu.com/security/CVE-2019-17571