Another Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021
Apache Log4j 2 RCE CVE-2021-44228 is actively exploited via crafted JNDI lookups; Palo Alto Unit 42 urges upgrading to Log4j 2.17.1.
92
CVE-2017-5645
- CVSS 3.1
- 9.8 critical
- EPSS
- 90%p100
- Published
- ·
- Modified
Description · NVD
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
- Products
- log4j, oncommand api services, oncommand insight, oncommand workflow automation, service level manager, snapcenter, storage automation store, fuse, enterprise linux, enterprise linux desktop, enterprise linux server, enterprise linux server aus
- Weakness
- CWE-502
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
2 stories60