Package · Maven

org.apache.logging.log4j:log4j

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

Critical 9.8

CVE-2017-5645 Public exploit Scanner template EPSS 89%

Deserialization of Untrusted Data in Log4j

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Apache Software Foundation Apache Log4j apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven

Apr 17, 2017