EXPOSURES › CVE-2017-5645
CVE-2017-5645
CRITICAL
DETAIL
SourceNVD · cve
Published2017-04-17
CVSS9.8
Referencehttps://nvd.nist.gov/vuln/detail/CVE-2017-5645 ↗
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
PLAYERS IMPLICATED
NetApp · vendorOracle · vendorapache · vendorredhat · vendorConfiguration Manager · productWebLogic Server · productapi gateway · productapplication testing suite · productautovue vuelink integration · productbanking platform · productbi publisher · productcommunications converged application server - service controller · productcommunications instant messaging server · productcommunications interactive session recorder · productcommunications messaging server · productcommunications network integrity · productcommunications online mediation controller · productcommunications pricing design center · productcommunications service broker · productcommunications webrtc session controller · productendeca information discovery studio · productenterprise data quality · productenterprise linux · productenterprise linux desktop · productenterprise linux server · productenterprise linux server aus · productenterprise linux server eus · productenterprise linux server tus · productenterprise linux workstation · productenterprise manager base platform · productenterprise manager for fusion middleware · productenterprise manager for mysql database · productenterprise manager for oracle database · productenterprise manager for peoplesoft · productfinancial services analytical applications infrastructure · productfinancial services behavior detection platform · productfinancial services hedge management and ifrs valuations · productfinancial services lending and leasing · productfinancial services loan loss forecasting and provisioning · productfinancial services profitability management · productfinancial services regulatory reporting with agilereporter · productflexcube investor servicing · productfuse · productfusion middleware mapviewer · productgoldengate · productgoldengate application adapters · productidentity analytics · productidentity management suite · productidentity manager connector · productin-memory performance-driven planning · productinstantis enterprisetrack · productinsurance calculation engine · productinsurance policy administration · productinsurance rules palette · productjd edwards enterpriseone tools · productjdeveloper · productlog4j · productmysql enterprise monitor · productoncommand api services · productoncommand insight · productoncommand workflow automation · productpeoplesoft enterprise fin install · productpolicy automation · productpolicy automation connector for siebel · productpolicy automation for mobile devices · productprimavera gateway · productrapid planning · productretail advanced inventory planning · productretail clearance optimization engine · productretail extract transform and load · productretail integration bus · productretail open commerce platform · productretail predictive application server · productretail service backbone · productservice level manager · productsiebel ui framework · productsnapcenter · productsoa suite · productstorage automation store · producttape library acsls · producttimesten in-memory database · productutilities advanced spatial and operational analytics · productutilities work and asset management · product
DESCRIPTION
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
SENTIMENT · TRUSTED SOURCES
synthesis
severe-fallout
-0.60
Apache faced severe fallout due to a critical remote code execution vulnerability in Log4j, widely condemned for the risk it posed to enterprise systems.
Apache faced severe fallout due to a critical remote code execution vulnerability in Log4j, widely condemned for the risk it posed to enterprise systems.
"In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code."
AFFECTED FEDRAMP PRODUCTS · 11
| PRODUCT | STATUS |
|---|---|
| Aconex for Defense Oracle |
Authorized |
| Cloud Insights NetApp |
In Process |
| Federal Managed Cloud Services Oracle |
Authorized |
| Fusion Cloud Oracle |
Authorized |
| Government Cloud - Common Controls Oracle |
Authorized |
| Oracle Cloud Infrastructure-Government Cloud Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) - Moderate Oracle |
In Process |
| Oracle Service Cloud Oracle |
Authorized |
| Oracle Service Cloud (DOD) Oracle |
Authorized |
| Taleo Cloud - U.S. Government Cloud Oracle |
Authorized |