Description
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Log4j | All versions between 2.0-alpha1 and 2.8.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache-log4j2 | 2.7-2 | — |
| Debian 13 | apache-log4j2 | 2.7-2 | — |
| Debian 12 | apache-log4j2 | 2.7-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | apache-log4j2 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | log4j +2 | 1.2.17-16.el7_4 | RHSA-2017:2423 |
| RHEL 2 | rh-java-common-log4j +2 | 1.2.17-15.15.el6 | RHSA-2017:1417 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 3 | log4j-eap6 | 1.2.16-12.redhat_3.1.ep6.el6 | RHSA-2017:1801 |
| Red Hat JBoss Web Server 3 | tomcat-native | 1.2.8-10.redhat_10.ep7.el6 | RHSA-2017:1801 |
| Red Hat JBoss Web Server 3 | tomcat7 +11 | 7.0.70-22.ep7.el6 | RHSA-2017:1801 |
| Red Hat JBoss Web Server 3 | tomcat8 +11 | 8.0.36-24.ep7.el6 | RHSA-2017:1801 |
| Red Hat JBoss EAP 7 | eap7-artemis-native +1 | 1.1.0-13.redhat_4.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-bouncycastle +3 | 1.56.0-3.redhat_2.2.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-hibernate-validator +1 | 5.2.5-2.Final_redhat_2.1.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-jasypt | 1.9.2-2.redhat_1.1.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-jboss-ec2-eap +1 | 7.0.8-1.GA_redhat_1.ep7.el6 | RHSA-2017:2811 |
| Red Hat JBoss EAP 7 | eap7-jboss-jms-api_2.0_spec | 1.0.1-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-jboss-logmanager | 2.0.7-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-jboss-metadata +5 | 10.0.2-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-jboss-remote-naming | 2.0.5-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 4.0.24-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-log4j-jboss-logmanager | 1.1.4-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-picketlink-api +9 | 2.5.5-9.SP8_redhat_1.1.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-undertow | 1.3.31-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-wildfly +1 | 7.0.8-4.GA_redhat_1.1.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-wildfly-javadocs | 7.0.8-1.GA_redhat_1.1.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 6 | apache-cxf | 2.7.18-7.SP6_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | codehaus-jackson +4 | 1.9.9-11.redhat_5.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | hibernate4-eap6 +4 | 4.2.27-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | hornetq | 2.3.25-22.SP20_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | infinispan +4 | 5.2.22-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | jboss-as-ee +60 | 7.5.17-2.Final_redhat_4.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | jboss-ec2-eap +1 | 7.5.17-1.Final_redhat_4.ep6.el6 | RHSA-2017:2638 |
| Red Hat JBoss EAP 6 | jboss-marshalling | 1.4.10-3.SP3_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | jboss-metadata +5 | 7.2.3-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | jboss-modules | 1.3.10-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | jboss-remoting3 | 3.3.10-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | jboss-vfs2 | 3.2.12-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.5.17-4.Final_redhat_4.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | jbossas-modules-eap | 7.5.17-1.Final_redhat_4.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | jbossweb | 7.5.24-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | log4j-eap6 | 1.2.16-12.redhat_3.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | log4j-jboss-logmanager | 1.1.4-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | picketlink-bindings +1 | 2.5.4-17.SP15_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 5 | log4j | 1.2.14-19.patch_01.ep5.el5 | RHSA-2017:3399 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | log4j +2 | 1.2.17-17.amzn2 | ALAS2-2022-1739 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | log4j +2 | 1.2.17-16.el7_4 | ELSA-2017-2423 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 2 repositories
-
pimps/CVE-2017-5645 ★ 92 · Aug 4, 2017
CVE-2017-5645 - Apache Log4j RCE due Insecure Deserialization
-
HynekPetrak/log4shell-finder ★ 39 · Dec 14, 2021
Fastest filesystem scanner for log4shell (CVE-2021-44228, CVE-2021-45046) and other vulnerable (CVE-2017-5645, CVE-2019-17571, CVE-2022-23305, CVE-2022-23307 ... ) instances of log4j library. Excelle…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Apache Log4j Server - Deserialization Command Execution network/cves/2017/CVE-2017-5645.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.logging.log4j:log4j | >= 2.0, < 2.8.2 | 2.8.2 | GHSA-fxph-q3j8-mv87 |
| Maven | org.apache.logging.log4j:log4j-core | >= 2.0, < 2.8.2 | 2.8.2 | GHSA-fxph-q3j8-mv87 |
Advisories 16
- RHSA-2017:1801 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 Service Pack 1 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2017:2811 Red Hat Security Advisory: eap7-jboss-ec2-eap security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2017:3399 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2017:2638 Red Hat Security Advisory: jboss-ec2-eap security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2017:2423 Red Hat Security Advisory: log4j security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2017:2809 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:2808 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:2636 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 7 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:2637 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 5 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:2635 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 6 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:1417 Red Hat Security Advisory: rh-java-common-log4j security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- WID-SEC-2025-1212 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 2, 2025
- WID-SEC-2024-2181 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 18, 2024
- WID-SEC-2024-2008 Oracle Virtualization: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 2, 2024
- ALAS2-2022-1739 Moderate: log4j security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 17, 2023
- ELSA-2017-2423 Important: log4j security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 9, 2017
References
- RHSA-2017:2888 vendor-advisory
- RHSA-2017:2809 vendor-advisory
- 97702 vdb-entry
- 1041294 vdb-entry
- RHSA-2017:2810 vendor-advisory
- RHSA-2017:1801 vendor-advisory
- RHSA-2017:2889 vendor-advisory
- RHSA-2017:2635 vendor-advisory
- RHSA-2017:2638 vendor-advisory
- RHSA-2017:1417 vendor-advisory
- RHSA-2017:2423 vendor-advisory
- RHSA-2017:2808 vendor-advisory
- 1040200 vdb-entry
- RHSA-2017:2636 vendor-advisory
- RHSA-2017:3399 vendor-advisory
- RHSA-2017:2637 vendor-advisory
- RHSA-2017:3244 vendor-advisory
- RHSA-2017:3400 vendor-advisory
- RHSA-2017:2633 vendor-advisory
- RHSA-2017:2811 vendor-advisory
- RHSA-2017:1802 vendor-advisory
- RHSA-2019:1545 vendor-advisory
- [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities mailing-list
- [logging-dev] 20191215 Re: Is there any chance that there will be a security fix for log4j-v1.2.17? mailing-list
- [logging-dev] 20191218 [CVE-2019-17571] Apache Log4j 1.2 deserialization of untrusted data in SocketServer mailing-list
- [oss-security] 20191218 [CVE-2019-17571] Apache Log4j 1.2 deserialization of untrusted data in SocketServer mailing-list
- [announce] 20191218 [CVE-2019-17571] Apache Log4j 1.2 deserialization of untrusted data in SocketServer mailing-list
- [logging-dev] 20191219 Re: [CVE-2019-17571] Apache Log4j 1.2 deserialization of untrusted data in SocketServer mailing-list
- [activemq-issues] 20191226 [jira] [Created] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 mailing-list
- [tika-dev] 20191226 [jira] [Created] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571 mailing-list
- [tika-dev] 20191226 [jira] [Commented] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571 mailing-list
- [tika-dev] 20191230 [jira] [Created] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] mailing-list
- [activemq-issues] 20191230 [jira] [Created] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10] mailing-list
- [tika-dev] 20200106 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] mailing-list
- [tika-dev] 20200107 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] mailing-list
- [tika-dev] 20200108 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] mailing-list
- [tika-dev] 20200110 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] mailing-list
- [tika-dev] 20200111 Re: [jira] [Commented] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571 mailing-list
- [tika-dev] 20200111 [jira] [Closed] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571 mailing-list
- [tika-dev] 20200111 [jira] [Resolved] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571 mailing-list
- [tika-dev] 20200114 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] mailing-list
- [tika-dev] 20200115 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] mailing-list
- [activemq-issues] 20200122 [jira] [Updated] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 mailing-list
- [activemq-issues] 20200122 [jira] [Assigned] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10] mailing-list
- [activemq-issues] 20200122 [jira] [Updated] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10] mailing-list
- [activemq-issues] 20200122 [jira] [Assigned] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 mailing-list
- [activemq-issues] 20200122 [jira] [Resolved] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10] mailing-list
- [activemq-issues] 20200127 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 mailing-list
- [activemq-issues] 20200208 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 mailing-list
- [activemq-issues] 20200228 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 mailing-list
- [activemq-issues] 20200228 [jira] [Resolved] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 mailing-list
- [activemq-issues] 20200228 [jira] [Updated] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 mailing-list
- [logging-commits] 20200425 svn commit: r1059809 - /websites/production/logging/content/log4j/2.13.2/security.html mailing-list
- https://www.oracle.com/security-alerts/cpuapr2020.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html