In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade log4j-javadocUpgrade log4jUpgrade log4j-manual | Aug 24, 2023 | Apr 17, 2017 |
| Amazon_linux | — | Upgrade log4j | Jan 20, 2022 | Apr 17, 2017 |
| Centos_linux | — | Upgrade log4j-javadocUpgrade log4j-manualUpgrade log4j | Aug 28, 2019 | Apr 17, 2017 |
| Debian | — | Upgrade apache-log4j2 | Jul 30, 2024 | Apr 17, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade log4j | Jan 18, 2018 | Apr 17, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade log4j | Jan 18, 2018 | Apr 17, 2017 |
| Oracle Solaris | — | Upgrade developer/build/ant to version 1.10.7-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Apr 17, 2017 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 27395085 for version 10.3.6.0.0.Apply the Patch Set Update (PSU) 27419391 for version 12.1.3.0.0.Apply the Patch Set Update (PSU) 27338939 for version 12.2.1.2.0.Apply the Patch Set Update (PSU) 27342434 for version 12.2.1.3.0. | Apr 3, 2018 | Apr 17, 2017 |
| Oracle_linux | — | Upgrade log4j-javadocUpgrade log4jUpgrade log4j-manual | Aug 9, 2017 | Apr 2, 2017 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Apr 2, 2017 |
| Redhat_linux | — | Upgrade log4j-javadocUpgrade log4j-manualUpgrade log4jNo solution exists | Aug 8, 2017 | Apr 17, 2017 |
| Suse | — | Upgrade log4j12-javadocUpgrade log4j12-manualUpgrade log4j12 | Feb 4, 2022 | Apr 17, 2017 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 17, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub