TROYANOSYVIRUS
Retour aux CVEs

CVE-2019-17571

CRITICAL
9.8

Description

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

Details CVE

Score CVSS v3.19.8
SeveriteCRITICAL
Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vecteur d'attaqueNETWORK
ComplexiteLOW
Privileges requisNONE
Interaction utilisateurNONE
Publie12/20/2019
Derniere modification11/21/2024
Sourcenvd
Observations honeypot0

Produits affectes

apache:bookkeeperapache:log4jcanonical:ubuntu_linuxdebian:debian_linuxnetapp:oncommand_system_managernetapp:oncommand_workflow_automationopensuse:leaporacle:application_testing_suiteoracle:communications_network_integrityoracle:endeca_information_discovery_studiooracle:financial_services_lending_and_leasingoracle:mysql_enterprise_monitororacle:primavera_gatewayoracle:rapid_planningoracle:retail_extract_transform_and_loadoracle:retail_service_backboneoracle:weblogic_server

Faiblesses (CWE)

CWE-502CWE-502

References

https://usn.ubuntu.com/4495-1/(security@apache.org)
https://security.netapp.com/advisory/ntap-20200110-0001/(af854a3a-2127-422b-91ae-364da2661108)
https://usn.ubuntu.com/4495-1/(af854a3a-2127-422b-91ae-364da2661108)
https://www.debian.org/security/2020/dsa-4686(af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpuApr2021.html(af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpuapr2020.html(af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpuapr2022.html(af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpujul2020.html(af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpujul2022.html(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.