https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Bug ID: 1443635
Summary: CVE-2017-5645 log4j: Socket receiver deserialization
vulnerability
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
aortega(a)redhat.com, apevec(a)redhat.com,
avibelli(a)redhat.com, ayoung(a)redhat.com,
bkearney(a)redhat.com, bmcclain(a)redhat.com,
cbillett(a)redhat.com, chazlett(a)redhat.com,
chrisw(a)redhat.com, coneill(a)redhat.com,
csutherl(a)redhat.com, cvsbot-xmlrpc(a)redhat.com,
dandread(a)redhat.com, dblechte(a)redhat.com,
devrim(a)gunduz.org, dwalluck(a)redhat.com,
eedri(a)redhat.com, etirelli(a)redhat.com,
gklein(a)redhat.com, gsterlin(a)redhat.com,
gvarsami(a)redhat.com, gzaronik(a)redhat.com,
hhorak(a)redhat.com, huwang(a)redhat.com,
java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jbalunas(a)redhat.com, jclere(a)redhat.com,
jcoleman(a)redhat.com, jjoyce(a)redhat.com,
jorton(a)redhat.com, jschluet(a)redhat.com,
jshepherd(a)redhat.com, kbasil(a)redhat.com,
kconner(a)redhat.com, kseifried(a)redhat.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
lgao(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com,
lpetrovi(a)redhat.com, lsurette(a)redhat.com,
markmc(a)redhat.com, mbabacek(a)redhat.com,
mbaluch(a)redhat.com, meissner(a)suse.de,
mgoldboi(a)redhat.com, michal.skrivanek(a)redhat.com,
mizdebsk(a)redhat.com, msimacek(a)redhat.com,
mwinkler(a)redhat.com, myarboro(a)redhat.com,
nwallace(a)redhat.com, pavelp(a)redhat.com,
rbalakri(a)redhat.com, rbryant(a)redhat.com,
Rhev-m-bugs(a)redhat.com, rrajasek(a)redhat.com,
rwagner(a)redhat.com, rzhang(a)redhat.com,
sclewis(a)redhat.com, sherold(a)redhat.com,
spinder(a)redhat.com, srevivo(a)redhat.com,
taw(a)redhat.com, tcunning(a)redhat.com,
tdecacqu(a)redhat.com, theute(a)redhat.com,
thomas(a)suse.de, tjay(a)redhat.com, tkirby(a)redhat.com,
tlestach(a)redhat.com, tomckay(a)redhat.com,
twalsh(a)redhat.com, weli(a)redhat.com, ydary(a)redhat.com,
ykaul(a)redhat.com
When using the TCP socket server or UDP socket server to receive serialized log
events from another application, a specially crafted binary payload can be sent
that, when deserialized, can execute arbitrary code.
References:
http://seclists.org/oss-sec/2017/q2/78
Upstream bug:
https://issues.apache.org/jira/browse/LOG4J2-1863
--
You are receiving this mail because:
You are on the CC list for the bug.