CVE-2019-17571
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
Published:Dec 20, 2019
Last Modified:May 28, 2026
EPS:Dec 20, 2019
EPSS Score:0.33799
CVSS Score:9.8
Affected Products
Vendor
Product
Action
Vendor
Apache
Product
Bookkeeper
Apache
Bookkeeper
Vendor
Apache
Product
Log4j
Apache
Log4j
Vendor
Canonical
Product
Ubuntu Linux
Canonical
Ubuntu Linux
Vendor
Debian
Product
Debian Linux
Debian
Debian Linux
Vendor
Netapp
Product
Oncommand System Manager
Netapp
Oncommand System Manager
Vendor
Netapp
Product
Oncommand Workflow Automation
Netapp
Oncommand Workflow Automation
Vendor
Opensuse
Product
Leap
Opensuse
Leap
Vendor
Oracle
Product
Application Testing Suite
Oracle
Application Testing Suite
Vendor
Oracle
Product
Communications Network Integrity
Oracle
Communications Network Integrity
Vendor
Oracle
Product
Endeca Information Discovery Studio
Oracle
Endeca Information Discovery Studio
Vendor
Oracle
Product
Financial Services Lending And Leasing
Oracle
Financial Services Lending And Leasing
Vendor
Oracle
Product
Mysql Enterprise Monitor
Oracle
Mysql Enterprise Monitor
Vendor
Oracle
Product
Primavera Gateway
Oracle
Primavera Gateway
Vendor
Oracle
Product
Rapid Planning
Oracle
Rapid Planning
Vendor
Oracle
Product
Retail Extract Transform And Load
Oracle
Retail Extract Transform And Load
Vendor
Oracle
Product
Retail Service Backbone
Oracle
Retail Service Backbone
Vendor
Oracle
Product
Weblogic Server
Oracle
Weblogic Server
Vendor
Redhat
Product
Enterprise Linux
Redhat
Enterprise Linux
Vendor
Redhat
Product
Jboss Bpms
Redhat
Jboss Bpms
Vendor
Redhat
Product
Jboss Data Grid
Redhat
Jboss Data Grid
Vendor
Redhat
Product
Jboss Data Virtualization
Redhat
Jboss Data Virtualization
Vendor
Redhat
Product
Jboss Enterprise Application Platform
Redhat
Jboss Enterprise Application Platform
Vendor
Redhat
Product
Jboss Enterprise Brms Platform
Redhat
Jboss Enterprise Brms Platform
Vendor
Redhat
Product
Jboss Enterprise Web Server
Redhat
Jboss Enterprise Web Server
Vendor
Redhat
Product
Jboss Fuse
Redhat
Jboss Fuse
Vendor
Redhat
Product
Rhel Els
Redhat
Rhel Els
Exploits
Common Weakness Enumeration
Common Attack Pattern Enumeration and Classification (CAPEC)
Related CVEs
References
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
