CVE-2019-17571 Deserialization of Untrusted Data in Log4j
Remote attackers can execute arbitrary code via deserialization in Log4j 1.x SocketServer if configured to listen for untrusted network traffic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-17571?
CVE-2019-17571 is a critical unsafe deserialization vulnerability in Canonical Ubuntu Linux, published on 20 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
Weakness: CWE-502
Which versions are affected by CVE-2019-17571?
4 open source packages ship an affected version, including log4j:log4j and org.zenframework.z8.dependencies.commons:log4j-1.2.17. It affects 17 products.
| Package | Affected | Fixed in |
|---|---|---|
log4j:log4j Maven | From 1.2 to 1.2.17 | None |
log4j:log4j Maven | From 1.2 to 1.2.17 | None |
org.zenframework.z8.dependencies.commons:log4j-1.2.17 Maven | All versions | None |
org.zenframework.z8.dependencies.commons:log4j-1.2.17 Maven | All versions | None |
Linux distribution packages (31)
log4j Red Hat:rhel_els:6 | All versions | 0:1.2.14-6.7.el6_10 |
log4j-debuginfo Red Hat:rhel_els:6 | All versions | 0:1.2.14-6.7.el6_10 |
log4j-javadoc Red Hat:rhel_els:6 | All versions | 0:1.2.14-6.7.el6_10 |
log4j-manual Red Hat:rhel_els:6 | All versions | 0:1.2.14-6.7.el6_10 |
log4j SUSE:Enterprise Storage 5 | All versions | 1.2.15-126.3.1 |
log4j SUSE:HPE Helion OpenStack 8 | All versions | 1.2.15-126.3.1 |
log4j SUSE:Linux Enterprise Module for Basesystem 15 | All versions | 1.2.17-5.3.1 |
log4j SUSE:Linux Enterprise Module for Basesystem 15 SP1 | All versions | 1.2.17-5.3.1 |
log4j SUSE:Linux Enterprise Module for Development Tools 15 | All versions | 1.2.17-5.3.1 |
log4j SUSE:Linux Enterprise Module for Development Tools 15 SP1 | All versions | 1.2.17-5.3.1 |
log4j SUSE:Linux Enterprise Point of Sale 11 SP3 | All versions | 1.2.15-26.32.14.1 |
log4j SUSE:Linux Enterprise Server 11 SP4-LTSS | All versions | 1.2.15-26.32.14.1 |
log4j SUSE:Linux Enterprise Server 12 SP1-LTSS | All versions | 1.2.15-126.3.1 |
log4j SUSE:Linux Enterprise Server 12 SP2-BCL | All versions | 1.2.15-126.3.1 |
log4j SUSE:Linux Enterprise Server 12 SP2-LTSS | All versions | 1.2.15-126.3.1 |
log4j SUSE:Linux Enterprise Server 12 SP3-BCL | All versions | 1.2.15-126.3.1 |
log4j SUSE:Linux Enterprise Server 12 SP3-LTSS | All versions | 1.2.15-126.3.1 |
log4j SUSE:Linux Enterprise Server 12 SP4 | All versions | 1.2.15-126.3.1 |
log4j SUSE:Linux Enterprise Server 12 SP5 | All versions | 1.2.15-126.3.1 |
log4j SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 1.2.15-126.3.1 |
log4j SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 1.2.15-126.3.1 |
log4j SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 1.2.15-126.3.1 |
log4j SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 1.2.15-126.3.1 |
log4j SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 1.2.15-126.3.1 |
log4j SUSE:Linux Enterprise Software Development Kit 12 SP4 | All versions | 1.2.15-126.3.1 |
log4j SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 1.2.15-126.3.1 |
log4j SUSE:OpenStack Cloud 7 | All versions | 1.2.15-126.3.1 |
log4j SUSE:OpenStack Cloud 8 | All versions | 1.2.15-126.3.1 |
log4j SUSE:OpenStack Cloud Crowbar 8 | All versions | 1.2.15-126.3.1 |
log4j openSUSE:Leap 15.1 | All versions | 1.2.17-lp151.5.3.1 |
log4j-mini openSUSE:Leap 15.1 | All versions | 1.2.17-lp151.5.3.1 |
Products include Apache Bookkeeper, Apache Log4j, Canonical Ubuntu Linux, Debian Debian Linux, Netapp Oncommand System Manager, Netapp Oncommand Workflow Automation and 11 more.
How do I fix CVE-2019-17571?
Product is end of life, replace it.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2019-17571 being exploited?
There is no known exploitation of CVE-2019-17571 in the wild and no public exploit code.
Public exploit code: 3 proofs of concept on GitHub.
Other vulnerabilities in Canonical Ubuntu Linux
- CVE-2017-6891 Memory corruption in GnuTLS libtasn1
- CVE-2020-36230 A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_elemen
- CVE-2019-19906 Memory corruption in n/a
- CVE-2020-23922 Memory corruption in n/a
- CVE-2022-32531 Apache BookKeeper: Java Client Uses Connection to Host that Failed Hostname Verification
Sources
Also known as CLEANSTART-2026-EJ90650, CLSA-2022-1655842760, CLSA-2022-1655843011, DEBIAN-CVE-2019-17571, DLA-2065-1, DSA-4686-1 and 11 more.