Description
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Log4j | versions up to 1.2.17 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache-log4j1.2 | 1.2.17-9 | — |
| Debian 13 | apache-log4j1.2 | 1.2.17-9 | — |
| Debian 12 | apache-log4j1.2 | 1.2.17-9 | — |
| Debian 10 | apache-log4j1.2 | 1.2.17-8+deb10u1 | DSA-4686-1 |
| Debian 9 | apache-log4j1.2 | 1.2.17-7+deb9u1 | DSA-4686-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | apache-log4j1.2 | 1.2.17-5+deb8u1 | DLA-2065-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | apache-log4j1.2 | 1.2.17-9ubuntu0.2 | USN-5998-1 |
| Ubuntu 18.04 LTS | apache-log4j1.2 | 1.2.17-8+deb10u1build0.18.04.1 | USN-5998-1, USN-4495-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | apache-log4j1.2 | 1.2.17-7ubuntu1+esm1 | USN-5998-1 |
| Ubuntu Pro 14.04 LTS | apache-log4j1.2 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | log4j +2 | 1.2.17-16.el7_4 | RHSA-2017:2423 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 ELS | log4j +2 | 1.2.14-6.7.el6_10 | RHSA-2022:5053 |
| Red Hat JBoss Web Server 3 | log4j-eap6 | 1.2.16-12.redhat_3.1.ep6.el6 | RHSA-2017:1801 |
| Red Hat JBoss Web Server 3 | tomcat-native | 1.2.8-10.redhat_10.ep7.el6 | RHSA-2017:1801 |
| Red Hat JBoss Web Server 3 | tomcat7 +11 | 7.0.70-22.ep7.el6 | RHSA-2017:1801 |
| Red Hat JBoss Web Server 3 | tomcat8 +11 | 8.0.36-24.ep7.el6 | RHSA-2017:1801 |
| Red Hat JBoss EAP 7 | eap7-jboss-ec2-eap +1 | 7.0.8-1.GA_redhat_1.ep7.el6 | RHSA-2017:2811 |
| Red Hat JBoss EAP 6 | jboss-ec2-eap +1 | 7.5.17-1.Final_redhat_4.ep6.el6 | RHSA-2017:2638 |
| Red Hat JBoss EAP 5 | log4j | 1.2.14-19.patch_01.ep5.el5 | RHSA-2017:3399 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | log4j | 1.2.17-5.3.1 | SUSE-SU-2020:0053-1 |
| SLES 15 | log4j | 1.2.17-5.3.1 | SUSE-SU-2020:0053-1 |
| SLES 12 SP5 | log4j | 1.2.15-126.3.1 | SUSE-SU-2020:0054-1 |
| SLES 12 SP4 | log4j | 1.2.15-126.3.1 | SUSE-SU-2020:0054-1 |
| SLES 12 SP3 | log4j | 1.2.15-126.3.1 | SUSE-SU-2020:0054-1 |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | log4j | 1.2.15-126.3.1 | SUSE-SU-2020:0054-1 |
| SLES 12 SP1 | log4j | 1.2.15-126.3.1 | SUSE-SU-2020:0054-1 |
| SLES 11 SP4 | log4j | 1.2.15-26.32.14.1 | SUSE-SU-2020:14267-1 |
| SLES for SAP 12 SP5 | log4j | 1.2.15-126.3.1 | SUSE-SU-2020:0054-1 |
| SLES for SAP 12 SP4 | log4j | 1.2.15-126.3.1 | SUSE-SU-2020:0054-1 |
| SLES for SAP 12 SP3 | log4j | 1.2.15-126.3.1 | SUSE-SU-2020:0054-1 |
| SLES for SAP 12 SP2 | log4j | 1.2.15-126.3.1 | SUSE-SU-2020:0054-1 |
| SLES for SAP 12 SP1 | log4j | 1.2.15-126.3.1 | SUSE-SU-2020:0054-1 |
| SUSE OpenStack Cloud Crowbar 8 | log4j | 1.2.15-126.3.1 | SUSE-SU-2020:0054-1 |
| SUSE OpenStack Cloud 8 | log4j | 1.2.15-126.3.1 | SUSE-SU-2020:0054-1 |
| SUSE OpenStack Cloud 7 | log4j | 1.2.15-126.3.1 | SUSE-SU-2020:0054-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | log4j | 1.2.15-26.32.14.1 | SUSE-SU-2020:14267-1 |
| SUSE HPE Helion OpenStack 8 | log4j | 1.2.15-126.3.1 | SUSE-SU-2020:0054-1 |
| SUSE Enterprise Storage 5 | log4j | 1.2.15-126.3.1 | SUSE-SU-2020:0054-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.1 | log4j +1 | 1.2.17-lp151.5.3.1 | openSUSE-SU-2020:0051-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | log4j +2 | 1.2.17-17.amzn2 | ALAS2-2022-1739 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | log4j +2 | 1.2.17-16.el7_4 | ELSA-2017-2423 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | druid | 35.0.1-r1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 3 repositories
-
shadow-horse/CVE-2019-17571 ★ 78 · Dec 25, 2019
Apache Log4j 1.2.X存在反序列化远程代码执行漏洞
-
HynekPetrak/log4shell-finder ★ 39 · Dec 14, 2021
Fastest filesystem scanner for log4shell (CVE-2021-44228, CVE-2021-45046) and other vulnerable (CVE-2017-5645, CVE-2019-17571, CVE-2022-23305, CVE-2022-23307 ... ) instances of log4j library. Excelle…
-
Al1ex/CVE-2019-17571 ★ 1 · Jul 16, 2020
Environment for CVE_2019_17571
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | log4j:log4j | >= 1.2, <= 1.2.17 | — | GHSA-2qrg-x229-3v8q |
| Maven | org.zenframework.z8.dependencies.commons:log4j-1.2.17 | 2.0 | — | GHSA-2qrg-x229-3v8q |
Advisories 24
- RHSA-2017:1801 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 Service Pack 1 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2022:5053 Red Hat Security Advisory: log4j security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2017:3399 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2017:2811 Red Hat Security Advisory: eap7-jboss-ec2-eap security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2017:2423 Red Hat Security Advisory: log4j security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2017:2638 Red Hat Security Advisory: jboss-ec2-eap security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- USN-5998-1 apache-log4j1.2 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-4495-1 Apache Log4j vulnerability Ubuntu Security Notices (USN) · May 29, 2026
- NCSC-2026-0091 Kwetsbaarheden verholpen in SAP-producten NCSC-NL (Netherlands) · Mar 12, 2026
- WID-SEC-2026-0647 SAP Patchday März 2026: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 9, 2026
- DSA-4686-1 apache-log4j1.2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2065-1 apache-log4j1.2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2020:0054-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0053-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:0051-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:14267-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-0770 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 8, 2026
- WID-SEC-2022-1375 JFrog Artifactory: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- WID-SEC-2023-0138 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
- WID-SEC-2024-0064 Juniper Produkte: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 10, 2025
- WID-SEC-2024-2181 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 18, 2024
- WID-SEC-2022-0368 Apache Log4j: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · May 14, 2024
- ALAS2-2022-1739 Moderate: log4j security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 17, 2023
- ELSA-2017-2423 Important: log4j security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 9, 2017
References
- [activemq-issues] 20191226 [jira] [Created] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 mailing-list
- [tika-dev] 20191226 [jira] [Created] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571 mailing-list
- [tika-dev] 20191226 [jira] [Commented] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571 mailing-list
- [tika-dev] 20191230 [jira] [Created] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] mailing-list
- [activemq-issues] 20191230 [jira] [Created] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10] mailing-list
- [kafka-jira] 20200105 [jira] [Created] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571 mailing-list
- [kafka-jira] 20200105 [jira] [Updated] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571 mailing-list
- [kafka-dev] 20200105 [jira] [Created] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571 mailing-list
- [kafka-jira] 20200106 [jira] [Commented] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571 mailing-list
- [kafka-jira] 20200106 [jira] [Assigned] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571 mailing-list
- [tika-dev] 20200106 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] mailing-list
- [kafka-jira] 20200107 [jira] [Updated] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571 mailing-list
- [zookeeper-issues] 20200107 [jira] [Created] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer mailing-list
- [zookeeper-dev] 20200107 [jira] [Created] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer mailing-list
- [zookeeper-issues] 20200107 [jira] [Commented] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer mailing-list
- [tika-dev] 20200107 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] mailing-list
- [zookeeper-issues] 20200108 [jira] [Commented] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer mailing-list
- [zookeeper-notifications] 20200108 [GitHub] [zookeeper] eolivelli opened a new pull request #1209: ZOOKEEPER-3677 owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer mailing-list
- [zookeeper-issues] 20200108 [jira] [Updated] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer mailing-list
- [zookeeper-issues] 20200108 [jira] [Assigned] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer mailing-list
- [tika-dev] 20200108 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] mailing-list
- [tika-dev] 20200110 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] mailing-list
- [tika-dev] 20200111 Re: [jira] [Commented] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571 mailing-list
- [tika-dev] 20200111 [jira] [Closed] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571 mailing-list
- [tika-dev] 20200111 [jira] [Resolved] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571 mailing-list
- [debian-lts-announce] 20200112 [SECURITY] [DLA 2065-1] apache-log4j1.2 security update mailing-list
- openSUSE-SU-2020:0051 vendor-advisory
- [tika-dev] 20200114 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] mailing-list
- [tika-dev] 20200115 [jira] [Commented] (TIKA-3019) [9.8] [CVE-2019-17571] [tika-app] [1.23] mailing-list
- [zookeeper-commits] 20200118 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3677: owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer mailing-list
- [zookeeper-dev] 20200118 Build failed in Jenkins: zookeeper-master-maven-owasp #329 mailing-list
- [zookeeper-commits] 20200118 [zookeeper] branch master updated: ZOOKEEPER-3677: owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer mailing-list
- [zookeeper-notifications] 20200118 [GitHub] [zookeeper] asfgit closed pull request #1209: ZOOKEEPER-3677 owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer mailing-list
- [zookeeper-commits] 20200118 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-3677: owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer mailing-list
- [zookeeper-issues] 20200118 [jira] [Resolved] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer mailing-list
- [activemq-issues] 20200122 [jira] [Updated] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 mailing-list
- [activemq-issues] 20200122 [jira] [Assigned] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10] mailing-list
- [activemq-issues] 20200122 [jira] [Updated] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10] mailing-list
- [activemq-issues] 20200122 [jira] [Assigned] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 mailing-list
- [activemq-issues] 20200122 [jira] [Resolved] (AMQ-7372) [9.8] [CVE-2019-17571] [activemq-all] [5.15.10] mailing-list
- [activemq-issues] 20200127 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 mailing-list
- [zookeeper-issues] 20200129 [jira] [Updated] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer mailing-list
- [zookeeper-user] 20200201 Re: Zookeeper 3.5.6 supports log4j 2.x? mailing-list
- [activemq-issues] 20200208 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 mailing-list
- [logging-log4j-user] 20200224 Apache Log4j - Migration activity to 2.12.1 version - Request to support for the queries posted mailing-list
- [activemq-issues] 20200228 [jira] [Commented] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 mailing-list
- [activemq-issues] 20200228 [jira] [Resolved] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 mailing-list
- [activemq-issues] 20200228 [jira] [Updated] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571 mailing-list
- [jena-dev] 20200318 Re: Logging (JENA-1005) mailing-list
- [druid-commits] 20200406 [GitHub] [druid] ccaominh commented on issue #9579: Add Apache Ranger Authorization mailing-list
- [zookeeper-commits] 20200504 [zookeeper] branch master updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488 mailing-list
- [zookeeper-commits] 20200504 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488 mailing-list
- [zookeeper-commits] 20200504 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488 mailing-list
- [kafka-jira] 20200514 [GitHub] [kafka] jeffhuang26 commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571 mailing-list
- DSA-4686 vendor-advisory
- [kafka-jira] 20200529 [GitHub] [kafka] ijuma commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571 mailing-list
- [kafka-jira] 20200602 [GitHub] [kafka] dongjinleekr commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571 mailing-list
- https://www.oracle.com/security-alerts/cpuapr2020.html
- [kafka-jira] 20200624 [GitHub] [kafka] dongjinleekr commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571 mailing-list
- [kafka-jira] 20200625 [GitHub] [kafka] dongjinleekr commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571 mailing-list