CVE-2017-5645

Critical

Published: 17/04/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In Apache Log4j 2.x before version 2.8.2, when using the TCP socket server or UDP socket server to receive log events, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Risk Assessment

An attacker can exploit this vulnerability to execute arbitrary code remotely, posing a serious threat to the security of the application and the organization's data.

Recommendation

It is recommended to upgrade Apache Log4j to version 2.8.2 or later to mitigate this vulnerability.

Original NVD description (English source)

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.