Critical · published April 18, 2017
CVSS calls it critical at 9.8. It sits in the 99.8th percentile for exploit probability.
⚠️ A specially crafted binary payload can turn your log system into a code-execution playground! 😱 Think of it like a delivery service accepting packages without checking the contents first — if a malicious sender decides to slip in a dangerous item, they could send chaos right to your doorstep! 📦 If an attacker exploits this vulnerability, they could execute any code they want on your server, potentially leading to data breaches, unauthorized access, or worse. It's like giving someone the keys to your entire operation — their access could be catastrophic!
Think of it like a delivery service accepting packages without checking the contents first — if a malicious sender decides to slip in a dangerous item, they could send chaos right to your doorstep! 📦 This vulnerability in Apache Log4j versions 2.x before 2.8.2 allows an attacker to send a malformed binary payload to TCP or UDP socket servers, which, upon deserialization, executes arbitrary code, bypassing all other security measures.
If an attacker exploits this vulnerability, they could execute any code they want on your server, potentially leading to data breaches, unauthorized access, or worse. It's like giving someone the keys to your entire operation — their access could be catastrophic! Upgrade to Apache Log4j version 2.8.2 or later to close this loophole immediately. Additionally, audit your logging configuration to ensure no unnecessary remote code execution features are enabled. Better safe than sorry! 🚀 You’ve got this! With these steps, you’ll keep your systems safe and sound! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| apache/log4j | ≥ 2.0, < 2.8.2 | 2.8.2 |
| netapp/oncommand_api_services | all versions | — |
| netapp/oncommand_insight | all versions | — |
| netapp/oncommand_workflow_automation | all versions | — |
| netapp/service_level_manager | all versions | — |
| netapp/snapcenter | all versions | — |
| netapp/storage_automation_store | all versions | — |
| redhat/fuse | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux_desktop | all versions | — |
| redhat/enterprise_linux_server | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_eus | all versions | — |
| redhat/enterprise_linux_server_eus | all versions | — |
| redhat/enterprise_linux_server_eus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_workstation | all versions | — |
| oracle/rapid_planning | all versions | — |
| oracle/rapid_planning | all versions | — |
| oracle/retail_advanced_inventory_planning | all versions | — |
| oracle/retail_advanced_inventory_planning | all versions | — |
| oracle/retail_clearance_optimization_engine | all versions | — |
| oracle/retail_extract_transform_and_load | all versions | — |
| oracle/retail_extract_transform_and_load | all versions | — |
| oracle/retail_extract_transform_and_load | all versions | — |
| oracle/retail_extract_transform_and_load | all versions | — |
| oracle/retail_integration_bus | all versions | — |
| oracle/retail_integration_bus | all versions | — |
| oracle/retail_integration_bus | all versions | — |
| oracle/retail_integration_bus | all versions | — |
| oracle/retail_open_commerce_platform | all versions | — |
| oracle/retail_open_commerce_platform | all versions | — |
| oracle/retail_open_commerce_platform | all versions | — |
| oracle/retail_predictive_application_server | all versions | — |
| oracle/retail_service_backbone | all versions | — |
| oracle/retail_service_backbone | all versions | — |
| oracle/retail_service_backbone | all versions | — |
| oracle/siebel_ui_framework | all versions | — |
| oracle/siebel_ui_framework | all versions | — |
| oracle/siebel_ui_framework | all versions | — |
| oracle/soa_suite | all versions | — |
| oracle/soa_suite | all versions | — |
| oracle/soa_suite | all versions | — |
| oracle/tape_library_acsls | all versions | — |
| oracle/timesten_in-memory_database | all versions | — |
| oracle/utilities_advanced_spatial_and_operational_analytics | all versions | — |
| oracle/utilities_work_and_asset_management | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/api_gateway | all versions | — |
| oracle/application_testing_suite | all versions | — |
| oracle/autovue_vuelink_integration | all versions | — |
| oracle/autovue_vuelink_integration | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/bi_publisher | all versions | — |
| oracle/bi_publisher | all versions | — |
| oracle/bi_publisher | all versions | — |
| oracle/bi_publisher | all versions | — |
| oracle/communications_converged_application_server_-_service_controller | all versions | — |
| oracle/communications_instant_messaging_server | all versions | — |
| oracle/communications_interactive_session_recorder | ≥ 6.0, ≤ 6.2 | — |
| oracle/communications_messaging_server | < 8.0.2 | 8.0.2 |
| oracle/communications_network_integrity | ≥ 7.3.2, ≤ 7.3.6 | — |
| oracle/communications_online_mediation_controller | all versions | — |
| oracle/communications_pricing_design_center | all versions | — |
| oracle/communications_pricing_design_center | all versions | — |
| oracle/communications_service_broker | all versions | — |
| oracle/communications_webrtc_session_controller | < 7.2 | 7.2 |
| oracle/configuration_manager | all versions | — |
| oracle/configuration_manager | all versions | — |
| oracle/endeca_information_discovery_studio | all versions | — |
| oracle/enterprise_data_quality | all versions | — |
| oracle/enterprise_manager_base_platform | all versions | — |
| oracle/enterprise_manager_base_platform | all versions | — |
| oracle/enterprise_manager_for_fusion_middleware | all versions | — |
| oracle/enterprise_manager_for_fusion_middleware | all versions | — |
| oracle/enterprise_manager_for_mysql_database | ≤ 13.2.2.0.0 | — |
| oracle/enterprise_manager_for_oracle_database | all versions | — |
| oracle/enterprise_manager_for_oracle_database | all versions | — |
| oracle/enterprise_manager_for_peoplesoft | all versions | — |
| oracle/enterprise_manager_for_peoplesoft | all versions | — |
| oracle/financial_services_analytical_applications_infrastructure | ≥ 7.3.3.0.0, ≤ 7.3.3.0.2 | — |
| oracle/financial_services_analytical_applications_infrastructure | ≥ 8.0.0.0.0, ≤ 8.0.7.0.0 | — |
| oracle/financial_services_behavior_detection_platform | ≥ 8.0.0.0.0, ≤ 8.0.4.0.0 | — |
| oracle/financial_services_behavior_detection_platform | all versions | — |
| oracle/financial_services_hedge_management_and_ifrs_valuations | all versions | — |
| oracle/financial_services_hedge_management_and_ifrs_valuations | all versions | — |
| oracle/financial_services_lending_and_leasing | ≥ 14.1.0, ≤ 14.8.0 | — |
| oracle/financial_services_lending_and_leasing | all versions | — |
| oracle/financial_services_loan_loss_forecasting_and_provisioning | all versions | — |
| oracle/financial_services_loan_loss_forecasting_and_provisioning | all versions | — |
| oracle/financial_services_profitability_management | ≥ 8.0.0.0.0, ≤ 8.0.7.0.0 | — |
| oracle/financial_services_profitability_management | all versions | — |
| oracle/financial_services_regulatory_reporting_with_agilereporter | all versions | — |
| oracle/flexcube_investor_servicing | all versions | — |
| oracle/flexcube_investor_servicing | all versions | — |
| oracle/flexcube_investor_servicing | all versions | — |
| oracle/flexcube_investor_servicing | all versions | — |
| oracle/flexcube_investor_servicing | all versions | — |
| oracle/fusion_middleware_mapviewer | all versions | — |
| oracle/fusion_middleware_mapviewer | all versions | — |
| oracle/goldengate | all versions | — |
| oracle/goldengate_application_adapters | all versions | — |
| oracle/identity_analytics | all versions | — |
| oracle/identity_management_suite | all versions | — |
| oracle/identity_management_suite | all versions | — |
| oracle/identity_manager_connector | all versions | — |
| oracle/in-memory_performance-driven_planning | all versions | — |
| oracle/in-memory_performance-driven_planning | all versions | — |
| oracle/instantis_enterprisetrack | ≥ 17.1, ≤ 17.3 | — |
| oracle/insurance_calculation_engine | all versions | — |
| oracle/insurance_calculation_engine | all versions | — |
| oracle/insurance_policy_administration | all versions | — |
| oracle/insurance_policy_administration | all versions | — |
| oracle/insurance_policy_administration | all versions | — |
| oracle/insurance_policy_administration | all versions | — |
| oracle/insurance_rules_palette | all versions | — |
| oracle/insurance_rules_palette | all versions | — |
| oracle/insurance_rules_palette | all versions | — |
| oracle/insurance_rules_palette | all versions | — |
| oracle/insurance_rules_palette | all versions | — |
| oracle/jd_edwards_enterpriseone_tools | all versions | — |
| oracle/jd_edwards_enterpriseone_tools | all versions | — |
| oracle/jdeveloper | all versions | — |
| oracle/jdeveloper | all versions | — |
| oracle/jdeveloper | all versions | — |
| oracle/mysql_enterprise_monitor | ≥ 3.4.0.0, ≤ 3.4.7.4297 | — |
| oracle/mysql_enterprise_monitor | ≥ 4.0.0.0, ≤ 4.0.4.5235 | — |
| oracle/mysql_enterprise_monitor | ≥ 8.0.0.0.0, ≤ 8.0.0.8131 | — |
| oracle/peoplesoft_enterprise_fin_install | all versions | — |
| oracle/policy_automation | all versions | — |
| oracle/policy_automation | all versions | — |
| oracle/policy_automation | all versions | — |
| oracle/policy_automation | all versions | — |
| oracle/policy_automation | all versions | — |
| oracle/policy_automation | all versions | — |
| oracle/policy_automation | all versions | — |
| oracle/policy_automation | all versions | — |
| oracle/policy_automation | all versions | — |
| oracle/policy_automation | all versions | — |
| oracle/policy_automation | all versions | — |
| oracle/policy_automation | all versions | — |
| oracle/policy_automation | all versions | — |
| oracle/policy_automation | all versions | — |
| oracle/policy_automation_connector_for_siebel | all versions | — |
| oracle/policy_automation_for_mobile_devices | all versions | — |
| oracle/policy_automation_for_mobile_devices | all versions | — |
| oracle/policy_automation_for_mobile_devices | all versions | — |
| oracle/policy_automation_for_mobile_devices | all versions | — |
| oracle/policy_automation_for_mobile_devices | all versions | — |
| oracle/policy_automation_for_mobile_devices | all versions | — |
| oracle/policy_automation_for_mobile_devices | all versions | — |
| oracle/policy_automation_for_mobile_devices | all versions | — |
| oracle/policy_automation_for_mobile_devices | all versions | — |
| oracle/policy_automation_for_mobile_devices | all versions | — |
| oracle/policy_automation_for_mobile_devices | all versions | — |
| oracle/policy_automation_for_mobile_devices | all versions | — |
| oracle/policy_automation_for_mobile_devices | all versions | — |
| oracle/policy_automation_for_mobile_devices | all versions | — |
| oracle/primavera_gateway | ≥ 16.2.0, ≤ 16.2.11 | — |
| oracle/primavera_gateway | ≥ 17.12.0, ≤ 17.12.7 | — |