Red Hat Security Advisory

RHSA-2017:3400

Red Hat JBoss Enterprise Application Platform 5.2 security update

Released 2017-12-07 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Application Platform 5.2 security update

Fixes 2 records

TI-2017-03645 CVE-2017-5645 · GHSA-fxph-q3j8-mv87

Deserialization of untrusted data in Apache Log4j

CRITICAL 91

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, c…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.89358 Published 2017-04-17 Partial fix · 2.8.2 CWE-502

TI-2019-13113 CVE-2019-17571 · GHSA-2qrg-x229-3v8q

Deserialization of untrusted data in Apache Log4j

CRITICAL 86

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening t…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.6998 Published 2019-12-20 Partial fix CWE-502