CVE-2019-17571: Log4j Deserialization of Untrusted Data
Summary
CVE-2019-17571: Deserialization of Untrusted Data in Log4j. Affects log4j:log4j versions >= 1.2, <= 1.2.17. No fix is published. How to fix ↓
Also tracked for
- apache-log4j1.2 · Debian:11
The same CVE-2019-17571 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Log4j is a popular logging library for Java applications. It provides a flexible and efficient framework for logging messages across different levels and destinations. Log4j 1.2 includes a SocketServer class that allows remote logging by listening to network traffic for log data. However, this class is vulnerable to deserialization of untrusted data, which can lead to remote code execution. The vulnerability affects Log4j versions 1.2 up to 1.2.17.
Vulnerability Detail
The vulnerability arises from the deserialization of untrusted data in the SocketServer class of Log4j. An attacker can exploit this by sending maliciously crafted log data over the network, which can trigger the execution of arbitrary code on the targeted system. This can result in a complete compromise of the affected system, allowing the attacker to gain unauthorized access, steal sensitive information, or perform other malicious activities.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If migration to org.apache.logging.log4j:log4j-core is not immediately feasible, a temporary workaround is to disable the SocketServer class in Log4j 1.2. This can be achieved by modifying the Log4j configuration file to remove any references to the SocketServer appender. By doing so, the application will no longer listen for log data over the network, mitigating the risk of deserialization attacks.
Conclusion
The Log4j vulnerability (CVE-2019-17571) allows for the remote execution of arbitrary code through the deserialization of untrusted data. To mitigate this risk, it is recommended to migrate to org.apache.logging.log4j:log4j-core or disable the SocketServer class in Log4j 1.2. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for log4j:log4j →
FAQ
Log4j is a logging library for Java applications that allows developers to easily incorporate logging functionality into their code. It provides a flexible and efficient framework for logging messages at different levels and to various destinations.
The vulnerability affects Log4j versions 1.2 up to 1.2.17. It does not impact Log4j 2.x versions.
The vulnerability can be exploited by an attacker to remotely execute arbitrary code on the targeted system. This can lead to unauthorized access, data theft, or other malicious activities.
To fix this vulnerability, it is recommended to migrate to the org.apache.logging.log4j:log4j-core package. Alternatively, you can disable the SocketServer class in Log4j 1.2 as a temporary workaround.
Yes, the CVSS score for this vulnerability is 9.8, indicating a critical severity level.
Related vulnerabilities
Recent vulnerabilities recorded for log4j:log4j.
