In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-log4jamazon-linux-ami-2-upgrade-log4j-javadocamazon-linux-ami-2-upgrade-log4j-manual | Aug 24, 2023 | Apr 17, 2017 | |
| Amazon_linux | — | amazon-linux-upgrade-log4j | Jan 20, 2022 | Apr 17, 2017 |
| Centos_linux | — | centos-upgrade-log4jcentos-upgrade-log4j-javadoccentos-upgrade-log4j-manual | Aug 28, 2019 | Apr 17, 2017 |
| Debian | debian-upgrade-apache-log4j2 | Jul 30, 2024 | Apr 17, 2017 | |
| Huawei Euleros 2_0_sp1 | huawei-euleros-2_0_sp1-upgrade-log4j | Jan 18, 2018 | Apr 17, 2017 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-log4j | Jan 18, 2018 | Apr 17, 2017 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-developer-build-ant-1-10-7-11-4-21-0-1-69-0 | Jan 19, 2021 | Apr 17, 2017 | |
| Oracle Weblogic | oracle-weblogic-apr-2018-cpu-10_3_6_0_0oracle-weblogic-apr-2018-cpu-12_1_3_0_0oracle-weblogic-apr-2018-cpu-12_2_1_2_0oracle-weblogic-apr-2018-cpu-12_2_1_3_0 | Apr 3, 2018 | Apr 17, 2017 | |
| Oracle_linux | — | oracle-linux-upgrade-log4joracle-linux-upgrade-log4j-javadocoracle-linux-upgrade-log4j-manual | Aug 9, 2017 | Apr 2, 2017 |
| Red Hat Jboss Eap | red-hat-jboss-eap-upgrade-latest | Sep 19, 2024 | Apr 2, 2017 | |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-log4jredhat-upgrade-log4j-javadocredhat-upgrade-log4j-manual | Aug 8, 2017 | Apr 17, 2017 | |
| Suse | — | suse-upgrade-log4j12suse-upgrade-log4j12-javadocsuse-upgrade-log4j12-manual | Feb 4, 2022 | Apr 17, 2017 |
| Ubuntu | no-fix-ubuntu-package | Jun 26, 2025 | Apr 17, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub