TROYANOSYVIRUS
Zuruck zu CVEs

CVE-2019-17571

CRITICAL
9.8

Beschreibung

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

CVE Details

CVSS v3.1 Bewertung9.8
SchweregradCRITICAL
CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AngriffsvektorNETWORK
KomplexitatLOW
Erforderliche PrivilegienNONE
BenutzerinteraktionNONE
Veroffentlicht12/20/2019
Zuletzt geandert11/21/2024
Quellenvd
Honeypot-Sichtungen0

Betroffene Produkte

apache:bookkeeperapache:log4jcanonical:ubuntu_linuxdebian:debian_linuxnetapp:oncommand_system_managernetapp:oncommand_workflow_automationopensuse:leaporacle:application_testing_suiteoracle:communications_network_integrityoracle:endeca_information_discovery_studiooracle:financial_services_lending_and_leasingoracle:mysql_enterprise_monitororacle:primavera_gatewayoracle:rapid_planningoracle:retail_extract_transform_and_loadoracle:retail_service_backboneoracle:weblogic_server

Schwachen (CWE)

CWE-502CWE-502

Referenzen

https://usn.ubuntu.com/4495-1/(security@apache.org)
https://security.netapp.com/advisory/ntap-20200110-0001/(af854a3a-2127-422b-91ae-364da2661108)
https://usn.ubuntu.com/4495-1/(af854a3a-2127-422b-91ae-364da2661108)
https://www.debian.org/security/2020/dsa-4686(af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpuApr2021.html(af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpuapr2020.html(af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpuapr2022.html(af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpujul2020.html(af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpujul2022.html(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.