Skip to content
Sign in
Not rated

CVE-2017-5645 In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events…

Description

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Affected products and versions

Product Affected versions Fixed in
Apache Log4j Versions not published

Other CVEs of Apache Log4j

The 3 CVEs of Apache Log4j →
CVE-2023-26464 ** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than… Not rated CVE-2021-45046 Apache Log4j2 Deserialization of Untrusted Data Vulnerability Not rated
Track this CVE