CVE-2019-17571

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

• Apache Bookkeeper

  APP
  Apache
  < 4.14.3

• Apache Log4j

  APP
  Apache
  ≤ 1.2.17

• Canonical Ubuntu

  OS
  Canonical
  18.04

• Debian

  OS
  Debian
  10.08.09.0

• Netapp Oncommand System Manager

  APP
  Netapp
  3.0 – 3.1.3

• Netapp Oncommand Workflow Automation

  APP
  Netapp
  wszystkie wersje

• Opensuse Leap

  OS
  Opensuse
  15.1

• Oracle Application Testing Suite

  APP
  Oracle
  13.3.0.1

• Oracle Communications Network Integrity

  APP
  Oracle
  7.3.2 – 7.3.6

• Oracle Endeca Information Discovery Studio

  APP
  Oracle
  3.2.0

• Oracle Financial Services Lending And Leasing

  APP
  Oracle
  12.5.014.1.0 – 14.8.0

• Oracle MySQL Enterprise Monitor

  APP
  Oracle
  ≤ 8.0.29

• Oracle Primavera Gateway

  APP
  Oracle
  17.12.0 – 17.12.716.2 – 16.2.11

• Oracle Rapid Planning

  APP
  Oracle
  12.112.2

• Oracle Retail Extract Transform And Load

  APP
  Oracle
  19.0

• Oracle Retail Service Backbone

  APP
  Oracle
  14.115.016.0

• Oracle Weblogic Server

  APP
  Oracle
  10.3.6.0.012.1.3.0.012.2.1.3.012.2.1.4.014.1.1.0.0