Detections
Analytics
CVE-2019-17571
critical
Description
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
References
https://www.oracle.com/security-alerts/cpujul2022.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.debian.org/security/2020/dsa-4686
https://usn.ubuntu.com/4495-1/
https://security.netapp.com/advisory/ntap-20200110-0001/
https://lists.debian.org/debian-lts-announce/2020/01/msg00008.html
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00022.html
https://thehackernews.com/2026/03/dozens-of-vendors-patch-security-flaws.html
https://www.securityweek.com/sap-patches-critical-fs-quo-netweaver-vulnerabilities/
https://github.com/hkelley/PsNvdCvss
https://github.com/tunakum/spektr
https://github.com/apifyforge/open-source-supply-chain-risk-mcp
https://github.com/Live-Hack-CVE/CVE-2019-17571
https://github.com/HynekPetrak/log4shell-finder
https://github.com/apache/logging-log4j2/pull/608
https://github.com/Al1ex/CVE-2019-17571
https://github.com/advisories/GHSA-2qrg-x229-3v8q