CVE-2017-5645 Deserialization of Untrusted Data in Log4j
Attackers can execute arbitrary code by sending crafted serialized payloads to Log4j's TCP or UDP socket servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-5645?
CVE-2017-5645 is a critical unsafe deserialization vulnerability in Netapp Oncommand Insight, published on 17 Apr 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
Weakness: CWE-502
Which versions are affected by CVE-2017-5645?
4 open source packages ship an affected version, including org.apache.logging.log4j:log4j and org.apache.logging.log4j:log4j-core. It affects 79 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.logging.log4j:log4j Maven | From 2.0 | 2.8.2 |
org.apache.logging.log4j:log4j Maven | From 2.0 | 2.8.2 |
org.apache.logging.log4j:log4j-core Maven | From 2.0 | 2.8.2 |
org.apache.logging.log4j:log4j-core Maven | From 2.0 | 2.8.2 |
Linux distribution packages (6)
rh-java-common-log4j Red Hat:rhel_software_collections:2::el6 | All versions | 0:1.2.17-15.15.el6 |
rh-java-common-log4j-javadoc Red Hat:rhel_software_collections:2::el6 | All versions | 0:1.2.17-15.15.el6 |
rh-java-common-log4j-manual Red Hat:rhel_software_collections:2::el6 | All versions | 0:1.2.17-15.15.el6 |
rh-java-common-log4j Red Hat:rhel_software_collections:2::el7 | All versions | 0:1.2.17-15.15.el7 |
rh-java-common-log4j-javadoc Red Hat:rhel_software_collections:2::el7 | All versions | 0:1.2.17-15.15.el7 |
rh-java-common-log4j-manual Red Hat:rhel_software_collections:2::el7 | All versions | 0:1.2.17-15.15.el7 |
Products include Apache Log4j, Netapp Oncommand Api Services, Netapp Oncommand Insight, Netapp Oncommand Workflow Automation, Netapp Service Level Manager, Netapp Snapcenter and 73 more.
How do I fix CVE-2017-5645?
Upgrade org.apache.logging.log4j:log4j to 2.8.2 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2017-5645 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-5645 exists.
Public exploit code: 1 Nuclei template and 2 proofs of concept on GitHub.
Other vulnerabilities in Netapp Oncommand Insight
- CVE-2021-44228 Apache Log4j2 Remote Code Execution
- CVE-2021-45046 Apache Log4j2 Deserialization of Untrusted Data
- CVE-2022-23305 SQL injection in JDBC Appender in Apache Log4j V1
- CVE-2022-23302 Deserialization of untrusted data in JMSSink in Apache Log4j 1.x
- CVE-2023-26464 Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender
Sources
Also known as DEBIAN-CVE-2017-5645, GHSA-fxph-q3j8-mv87, RHSA-2017:1417, UBUNTU-CVE-2017-5645.