Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade log4j-javadocUpgrade log4jUpgrade log4j-manual | Aug 24, 2023 | Dec 20, 2019 |
| Amazon_linux | — | Upgrade log4j | Jan 20, 2022 | Dec 20, 2019 |
| Centos_linux | — | Upgrade log4j-javadocUpgrade log4jUpgrade log4j-debuginfoUpgrade log4j-manual | Dec 30, 2019 | Dec 20, 2019 |
| Debian | — | Upgrade apache-log4j1.2 | Jan 14, 2020 | Dec 20, 2019 |
| Gentoo Linux | — | Upgrade dev-java/log4j. | Feb 19, 2024 | Dec 20, 2019 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 29659185 for version 10.3.6.0.0.Apply the Patch Set Update (PSU) 30965714 for version 12.2.1.3.0.Apply the Patch Set Update (PSU) 30857795 for version 12.1.3.0.0. | Apr 15, 2020 | Dec 20, 2019 |
| Oracle_linux | — | Upgrade log4j-javadocUpgrade log4j-manualUpgrade log4j | Jan 21, 2026 | Dec 20, 2019 |
| Progress Moveit Automation | — | Upgrade Progress MOVEit Automation to the latest version | Dec 13, 2024 | Dec 20, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Dec 20, 2019 |
| Redhat_linux | — | Upgrade log4j-manualUpgrade log4j-debuginfoNo solution existsUpgrade log4jUpgrade log4j-javadoc | Dec 30, 2019 | Dec 20, 2019 |
| Suse | — | Upgrade log4j-javadocUpgrade log4jUpgrade log4j12-manualUpgrade log4j-manualUpgrade log4j12Upgrade log4j12-javadocUpgrade log4j-mini | Jan 10, 2020 | Dec 20, 2019 |
| Ubuntu | — | Upgrade liblog4j1.2-java (Ubuntu Pro)Upgrade liblog4j1.2-java | Sep 16, 2020 | Dec 20, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub