CVE Catalog
CVE-2019-17571
CriticalSummary
The SocketServer class in Log4j 1.2 is vulnerable to deserialization of untrusted data, which can lead to remote execution of arbitrary code. This issue affects Log4j versions from 1.2 up to 1.2.17.
Risk Assessment
Organizations may be exposed to remote attacks that could lead to system compromise if they do not upgrade Log4j to a secure version.
Recommendation
It is recommended to upgrade Log4j to version 1.2.18 or later to mitigate this vulnerability.
Original NVD description (English source)
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.