CVE-2019-17571

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 70.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-12-20 · updated 2026-06-17
Weakness: CWE-502

Description

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

Affected products

Apache Software Foundation Apache BookKeeper: before 4.14.3 — fixed in 4.14.3
Apache Log4j: through 1.2.17
Canonical Ubuntu Linux: 18.04
Debian Linux: 8.0, 9.0, 10.0
OnCommand System Manager 9.x: from 3.0 through 3.1.3
NetApp OnCommand Workflow Automation: all versions
openSUSE Leap: 15.1
Oracle Corporation Oracle Application Testing Suite: 13.3.0.1
Oracle Communications Network Integrity: from 7.3.2 through 7.3.6
Oracle Endeca Information Discovery Studio: 3.2.0
Oracle Financial Services Lending And Leasing: from 14.1.0 through 14.8.0; 12.5.0
Oracle Corporation MySQL Enterprise Monitor: through 8.0.29
Oracle Corporation Primavera Gateway: from 16.2 through 16.2.11; from 17.12.0 through 17.12.7
Oracle Corporation Rapid Planning: 12.1, 12.2
Oracle Retail Extract Transform And Load: 19.0
Oracle Retail Service Backbone: 14.1, 15.0, 16.0
Oracle WebLogic Server: 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache BookKeeper 4.14.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-17571 or the next vulnerability affects your stack