CVE-2017-5645

—

CVSS 3.1

9.8 critical

EPSS

90%p100

Published

Apr 17, 2017 (Apr 17, 2017)

Modified

Jun 17, 2026

Description

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Vendors: apache netapp redhat oracle
Products: log4j, oncommand api services, oncommand insight, oncommand workflow automation, service level manager, snapcenter, storage automation store, fuse, enterprise linux, enterprise linux desktop, enterprise linux server, enterprise linux server aus
Weakness: CWE-502
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (89.8%)

In the news2 stories

Another Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021

Apache Log4j 2 RCE CVE-2021-44228 is actively exploited via crafted JNDI lookups; Palo Alto Unit 42 urges upgrading to Log4j 2.17.1.

Unit 42 details CVE-2021-44228, an easily exploited remote code execution flaw in Apache Log4j 2 where attacker-supplied JNDI lookups in logged user input cause payload download and execution. Massive internet-wide scanning for unpatched systems has begun, with observed follow-on activity including information stealing, Cobalt Strike delivery, and coinmining. The recommended fix is Log4j 2.17.1, which also patches CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832. Widely used Java software including Apache Struts, Solr, Druid, Flink, ElasticSearch, and Spring Boot is affected.

Palo Alto Unit 42Aug 17, 12:20 UTC · 29d agoExploit / PoC in the wildCVE-2021-44228 CVE-2021-45046 CVE-2021-45105+3 CVEs

Oracle critical patch advisory addresses 284 flaws, 33 critical

Security AffairsJan 18, 13:15 UTC · Jan 18, 2019Vulnerability CVE-2016-1000031 CVE-2017-5645 CVE-2018-11776+3 CVEs