CVE-2017-5645: Deserialization of Untrusted Data in Log4j
Summary
CVE-2017-5645: Deserialization of Untrusted Data in Log4j. Affects org.apache.logging.log4j:log4j versions >= 2.0, < 2.8.2. Fixed in 2.8.2. How to fix ↓
Also tracked for
- apache-log4j2 · Debian:11
The same CVE-2017-5645 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Log4j is a popular logging framework for Java applications. It provides a flexible and efficient way to log messages across different levels of severity. Log4j consists of multiple modules, including log4j-core, which is responsible for the core logging functionality. This vulnerability affects versions of Log4j 2.x prior to 2.8.2. The vulnerability arises when using the TCP socket server or UDP socket server to receive serialized log events from another application. An attacker can send a specially crafted binary payload that, when deserialized, can execute arbitrary code.
Vulnerability Detail
The vulnerability in Log4j arises due to the deserialization of untrusted data. By sending a malicious payload, an attacker can exploit the deserialization process and execute arbitrary code on the target system. This can lead to various consequences, including remote code execution, privilege escalation, and unauthorized access to sensitive information. The vulnerability has a CVSSv3 score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 3.0.0-beta3 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.8.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest Log4j version is not immediately feasible, a temporary workaround is to disable the TCP socket server and UDP socket server in your Log4j configuration. By removing or commenting out the corresponding appender configurations, you can prevent the exploitation of this vulnerability. However, this workaround may impact the functionality of applications that rely on remote logging.
Conclusion
The vulnerability in Log4j allows for the deserialization of untrusted data, leading to potential remote code execution and other security risks. It is crucial to upgrade to Log4j version 2.8.2 or later to mitigate this vulnerability. Regularly updating dependencies and following secure coding practices are essential for maintaining the security of your applications. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.logging.log4j:log4j →
FAQ
Log4j is a popular logging framework for Java applications. It provides a flexible and efficient way to log messages across different levels of severity.
Versions of Log4j 2.x prior to 2.8.2 are affected by this vulnerability.
The vulnerability allows an attacker to execute arbitrary code on the target system, potentially leading to remote code execution, privilege escalation, and unauthorized access to sensitive information.
To fix this vulnerability, upgrade to Log4j version 2.8.2 or later. Update the Log4j dependency in your project's pom.xml file and rebuild your application.
A temporary workaround is to disable the TCP socket server and UDP socket server in your Log4j configuration.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.logging.log4j:log4j.
