This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2019-17571 →

DEBIAN-CVE-2019-17571

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbit...

Original description

The description as published by the source.

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 apache-log4j1.2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.17-9"}]}]

Debian:13 apache-log4j1.2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.17-9"}]}]

Debian:14 apache-log4j1.2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.17-9"}]}]

References

advisory security-tracker.debian.org