Apache Log4j CVE-2017-5645 Remote Code Execution Vulnerability
by CIRT Team
Description: In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
Impact: Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application. Failed exploits will result in denial-of-service conditions. Apache Log4j 2.0-alpha1 through 2.8.1 are vulnerable.
Mitigation: Updates are available. Please check specific vendor advisory for more information.
26 Oct 2023 - Security Advisories & Alerts