CVE-2019-17571: Critical severity IBM QRadar SIEM vulnerability
A flaw was discovered in Log4j, where a vulnerable SocketServer class may lead to the deserialization of untrusted data. This flaw allows an attacker to remotely execute arbitrary code when combined with a deserialization gadget.
Other sources
Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by improper deserialization of untrusted data in SocketServer. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
— IBM
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data.
References:
https://logging.apache.org/log4j/1.2/ https://issues.apache.org/jira/browse/LOG4J2-1863 https://lists.apache.org/thread.html/84cc4266238e057b95eb95dfd8b29d46a2592e7672c12c92f68b2917%40%3Cannounce.apache.org%3E
— Red Hat
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions 1.2 up to 1.2.17.
Users are advised to migrate to org.apache.logging.log4j:log4j-core.
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-17571?
CVE-2019-17571 is a vulnerability in Log4j where a vulnerable SocketServer class may lead to the deserialization of untrusted data, allowing remote code execution.
What is the severity of CVE-2019-17571?
CVE-2019-17571 has a severity value of 9, which is considered critical.
How does CVE-2019-17571 affect Log4j?
CVE-2019-17571 affects Log4j versions up to 1.2, allowing for remote code execution.
What is the recommended remedy for CVE-2019-17571?
The recommended remedy for CVE-2019-17571 is to update Log4j to version 1.2.14-6.7.el6_10 or higher.
Where can I find more information about CVE-2019-17571?
You can find more information about CVE-2019-17571 at the following sources: [CVE](https://www.cve.org/CVERecord?id=CVE-2019-17571), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-17571), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1785616), [Red Hat Advisory](https://access.redhat.com/errata/RHSA-2022:5053).