Read the docs
TI-2017-03645 Aliases CVE-2017-5645GHSA-fxph-q3j8-mv87

Deserialization of untrusted data in Apache Log4j

Priority CRITICAL 91CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 32 fixed, 11 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.89358 99th percentileScored 2026-11-07
Fix Partial org.apache.logging.log4j:log4j (Maven): 2.8.2org.apache.logging.log4j:log4j-core (Maven): 2.8.2Red Hat: 20 advisoriesRed Hat: 32 fixed, 11 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Log4jAll versions between 2.0-alpha1 and 2.8.1—No fix listedCNA
—org.apache.logging.log4j:log4j (Maven)2.0 to before 2.8.22.8.2Patch availableGHSA-fxph-q3j8-mv87
—org.apache.logging.log4j:log4j-core (Maven)2.0 to before 2.8.22.8.2Patch availableGHSA-fxph-q3j8-mv87
  • Apache Log4j VendorApache Affected All versions between 2.0-alpha1 and 2.8.1 Fixed in — No fix listed CNA
  • org.apache.logging.log4j:log4j (Maven) Vendor— Affected 2.0 to before 2.8.2 Fixed in 2.8.2 Patch available GHSA-fxph-q3j8-mv87
  • org.apache.logging.log4j:log4j-core (Maven) Vendor— Affected 2.0 to before 2.8.2 Fixed in 2.8.2 Patch available GHSA-fxph-q3j8-mv87

CPE configurations NVD · 170

CPEVersionsRoleVendor
cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*2.0 to before 2.8.2VulnerableApache
cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.7:*:*:*:*:*:*:*6.7VulnerableRed Hat
  • cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* Versions 2.0 to before 2.8.2 Vulnerable ·Apache
  • cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.7:*:*:*:*:*:*:* Versions 6.7 Vulnerable ·Red Hat
Show 160 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.3:*:*:*:*:*:*:*7.3VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:*7.5VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.6:*:*:*:*:*:*:*7.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*7.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*7.5VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*7.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*7.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:*11.1.2.4.0VulnerableOracle
cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*13.3.0.1VulnerableOracle
cpe:2.3:a:oracle:autovue_vuelink_integration:21.0.0:*:*:*:*:*:*:*21.0.0VulnerableOracle
cpe:2.3:a:oracle:autovue_vuelink_integration:21.0.1:*:*:*:*:*:*:*21.0.1VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*2.6.0VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:*2.6.1VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*2.6.2VulnerableOracle
cpe:2.3:a:oracle:bi_publisher:11.1.1.7.0:*:*:*:*:*:*:*11.1.1.7.0VulnerableOracle
cpe:2.3:a:oracle:bi_publisher:11.1.1.9.0:*:*:*:*:*:*:*11.1.1.9.0VulnerableOracle
cpe:2.3:a:oracle:bi_publisher:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_converged_application_server_-_service_controller:6.1:*:*:*:*:*:*:*6.1VulnerableOracle
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.3.0:*:*:*:*:*:*:*10.0.1.3.0VulnerableOracle
cpe:2.3:a:oracle:communications_interactive_session_recorder:*:*:*:*:*:*:*:*6.0 – 6.2VulnerableOracle
cpe:2.3:a:oracle:communications_messaging_server:*:*:*:*:*:*:*:*before 8.0.2VulnerableOracle
cpe:2.3:a:oracle:communications_network_integrity:*:*:*:*:*:*:*:*7.3.2 – 7.3.6VulnerableOracle
cpe:2.3:a:oracle:communications_online_mediation_controller:6.1:*:*:*:*:*:*:*6.1VulnerableOracle
cpe:2.3:a:oracle:communications_pricing_design_center:11.1:*:*:*:*:*:*:*11.1VulnerableOracle
cpe:2.3:a:oracle:communications_pricing_design_center:12.0:*:*:*:*:*:*:*12.0VulnerableOracle
cpe:2.3:a:oracle:communications_service_broker:6.0:*:*:*:*:*:*:*6.0VulnerableOracle
cpe:2.3:a:oracle:communications_webrtc_session_controller:*:*:*:*:*:*:*:*before 7.2VulnerableOracle
cpe:2.3:a:oracle:configuration_manager:12.1.2.0.2:*:*:*:*:*:*:*12.1.2.0.2VulnerableOracle
cpe:2.3:a:oracle:configuration_manager:12.1.2.0.5:*:*:*:*:*:*:*12.1.2.0.5VulnerableOracle
cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_data_quality:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_base_platform:12.1.0.5:*:*:*:*:*:*:*12.1.0.5VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2.0.0:*:*:*:*:*:*:*13.2.0.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_for_fusion_middleware:12.1.0.5:*:*:*:*:*:*:*12.1.0.5VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_for_fusion_middleware:13.2.0.0:*:*:*:*:*:*:*13.2.0.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_for_mysql_database:*:*:*:*:*:*:*:*up to 13.2.2.0.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_for_oracle_database:12.1.0.8:*:*:*:*:*:*:*12.1.0.8VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_for_oracle_database:13.2.2:*:*:*:*:*:*:*13.2.2VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_for_peoplesoft:13.1.1.1:*:*:*:*:*:*:*13.1.1.1VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_for_peoplesoft:13.2.1.1:*:*:*:*:*:*:*13.2.1.1VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*7.3.3.0.0 – 7.3.3.0.2; 8.0.0.0.0 – 8.0.7.0.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_behavior_detection_platform:*:*:*:*:*:*:*:*8.0.0.0.0 – 8.0.4.0.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_behavior_detection_platform:6.1.1:*:*:*:*:*:*:*6.1.1VulnerableOracle
cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:8.0.4:*:*:*:*:*:*:*8.0.4VulnerableOracle
cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:8.0.5:*:*:*:*:*:*:*8.0.5VulnerableOracle
cpe:2.3:a:oracle:financial_services_lending_and_leasing:*:*:*:*:*:*:*:*14.1.0 – 14.8.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_lending_and_leasing:12.5.0:*:*:*:*:*:*:*12.5.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.0.4:*:*:*:*:*:*:*8.0.4VulnerableOracle
cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.0.5:*:*:*:*:*:*:*8.0.5VulnerableOracle
cpe:2.3:a:oracle:financial_services_profitability_management:*:*:*:*:*:*:*:*8.0.0.0.0 – 8.0.7.0.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_profitability_management:6.1.1:*:*:*:*:*:*:*6.1.1VulnerableOracle
cpe:2.3:a:oracle:financial_services_regulatory_reporting_with_agilereporter:8.0.9.2.0:*:*:*:*:*:*:*8.0.9.2.0VulnerableOracle
cpe:2.3:a:oracle:flexcube_investor_servicing:12.0.4:*:*:*:*:*:*:*12.0.4VulnerableOracle
cpe:2.3:a:oracle:flexcube_investor_servicing:12.1.0:*:*:*:*:*:*:*12.1.0VulnerableOracle
cpe:2.3:a:oracle:flexcube_investor_servicing:12.3.0:*:*:*:*:*:*:*12.3.0VulnerableOracle
cpe:2.3:a:oracle:flexcube_investor_servicing:12.4.0:*:*:*:*:*:*:*12.4.0VulnerableOracle
cpe:2.3:a:oracle:flexcube_investor_servicing:14.0.0:*:*:*:*:*:*:*14.0.0VulnerableOracle
cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.2:*:*:*:*:*:*:*12.2.1.2VulnerableOracle
cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.3:*:*:*:*:*:*:*12.2.1.3VulnerableOracle
cpe:2.3:a:oracle:goldengate:12.3.2.1.1:*:*:*:*:*:*:*12.3.2.1.1VulnerableOracle
cpe:2.3:a:oracle:goldengate_application_adapters:12.3.2.1.1:*:*:*:*:*:*:*12.3.2.1.1VulnerableOracle
cpe:2.3:a:oracle:identity_analytics:11.1.1.5.8:*:*:*:*:*:*:*11.1.1.5.8VulnerableOracle
cpe:2.3:a:oracle:identity_management_suite:11.1.2.3.0:*:*:*:*:*:*:*11.1.2.3.0VulnerableOracle
cpe:2.3:a:oracle:identity_management_suite:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:identity_manager_connector:9.0:*:*:*:*:*:*:*9.0VulnerableOracle
cpe:2.3:a:oracle:in-memory_performance-driven_planning:12.1:*:*:*:*:*:*:*12.1VulnerableOracle
cpe:2.3:a:oracle:in-memory_performance-driven_planning:12.2:*:*:*:*:*:*:*12.2VulnerableOracle
cpe:2.3:a:oracle:instantis_enterprisetrack:*:*:*:*:*:*:*:*17.1 – 17.3VulnerableOracle
cpe:2.3:a:oracle:insurance_calculation_engine:10.1.1:*:*:*:*:*:*:*10.1.1VulnerableOracle
cpe:2.3:a:oracle:insurance_calculation_engine:10.2.1:*:*:*:*:*:*:*10.2.1VulnerableOracle
cpe:2.3:a:oracle:insurance_policy_administration:10.0:*:*:*:*:*:*:*10.0VulnerableOracle
cpe:2.3:a:oracle:insurance_policy_administration:10.1:*:*:*:*:*:*:*10.1VulnerableOracle
cpe:2.3:a:oracle:insurance_policy_administration:10.2:*:*:*:*:*:*:*10.2VulnerableOracle
cpe:2.3:a:oracle:insurance_policy_administration:11.0:*:*:*:*:*:*:*11.0VulnerableOracle
cpe:2.3:a:oracle:insurance_rules_palette:10.0:*:*:*:*:*:*:*10.0VulnerableOracle
cpe:2.3:a:oracle:insurance_rules_palette:10.1:*:*:*:*:*:*:*10.1VulnerableOracle
cpe:2.3:a:oracle:insurance_rules_palette:10.2:*:*:*:*:*:*:*10.2VulnerableOracle
cpe:2.3:a:oracle:insurance_rules_palette:11.0:*:*:*:*:*:*:*11.0VulnerableOracle
cpe:2.3:a:oracle:insurance_rules_palette:11.1:*:*:*:*:*:*:*11.1VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:4.0.1.0:*:*:*:*:*:*:*4.0.1.0VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:*9.2VulnerableOracle
cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:*11.1.1.9.0VulnerableOracle
cpe:2.3:a:oracle:jdeveloper:12.1.3.0.0:*:*:*:*:*:*:*12.1.3.0.0VulnerableOracle
cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*3.4.0.0 – 3.4.7.4297; 4.0.0.0 – 4.0.4.5235; 8.0.0.0.0 – 8.0.0.8131VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_fin_install:9.2:*:*:*:*:*:*:*9.2VulnerableOracle
cpe:2.3:a:oracle:policy_automation:10.4.7:*:*:*:*:*:*:*10.4.7VulnerableOracle
cpe:2.3:a:oracle:policy_automation:12.1.0:*:*:*:*:*:*:*12.1.0VulnerableOracle
cpe:2.3:a:oracle:policy_automation:12.1.1:*:*:*:*:*:*:*12.1.1VulnerableOracle
cpe:2.3:a:oracle:policy_automation:12.2.0:*:*:*:*:*:*:*12.2.0VulnerableOracle
cpe:2.3:a:oracle:policy_automation:12.2.1:*:*:*:*:*:*:*12.2.1VulnerableOracle
cpe:2.3:a:oracle:policy_automation:12.2.2:*:*:*:*:*:*:*12.2.2VulnerableOracle
cpe:2.3:a:oracle:policy_automation:12.2.3:*:*:*:*:*:*:*12.2.3VulnerableOracle
cpe:2.3:a:oracle:policy_automation:12.2.4:*:*:*:*:*:*:*12.2.4VulnerableOracle
cpe:2.3:a:oracle:policy_automation:12.2.5:*:*:*:*:*:*:*12.2.5VulnerableOracle
cpe:2.3:a:oracle:policy_automation:12.2.6:*:*:*:*:*:*:*12.2.6VulnerableOracle
cpe:2.3:a:oracle:policy_automation:12.2.7:*:*:*:*:*:*:*12.2.7VulnerableOracle
cpe:2.3:a:oracle:policy_automation:12.2.8:*:*:*:*:*:*:*12.2.8VulnerableOracle
cpe:2.3:a:oracle:policy_automation:12.2.9:*:*:*:*:*:*:*12.2.9VulnerableOracle
cpe:2.3:a:oracle:policy_automation:12.2.10:*:*:*:*:*:*:*12.2.10VulnerableOracle
cpe:2.3:a:oracle:policy_automation_connector_for_siebel:10.4.6:*:*:*:*:*:*:*10.4.6VulnerableOracle
cpe:2.3:a:oracle:policy_automation_for_mobile_devices:10.4.7:*:*:*:*:*:*:*10.4.7VulnerableOracle
cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.1.0:*:*:*:*:*:*:*12.1.0VulnerableOracle
cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.1.1:*:*:*:*:*:*:*12.1.1VulnerableOracle
cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.0:*:*:*:*:*:*:*12.2.0VulnerableOracle
cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.1:*:*:*:*:*:*:*12.2.1VulnerableOracle
cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.2:*:*:*:*:*:*:*12.2.2VulnerableOracle
cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.3:*:*:*:*:*:*:*12.2.3VulnerableOracle
cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.4:*:*:*:*:*:*:*12.2.4VulnerableOracle
cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.5:*:*:*:*:*:*:*12.2.5VulnerableOracle
cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.6:*:*:*:*:*:*:*12.2.6VulnerableOracle
cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.7:*:*:*:*:*:*:*12.2.7VulnerableOracle
cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.8:*:*:*:*:*:*:*12.2.8VulnerableOracle
cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.9:*:*:*:*:*:*:*12.2.9VulnerableOracle
cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.10:*:*:*:*:*:*:*12.2.10VulnerableOracle
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*16.2.0 – 16.2.11; 17.12.0 – 17.12.7VulnerableOracle
cpe:2.3:a:oracle:rapid_planning:12.1:*:*:*:*:*:*:*12.1VulnerableOracle
cpe:2.3:a:oracle:rapid_planning:12.2:*:*:*:*:*:*:*12.2VulnerableOracle
cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.0:*:*:*:*:*:*:*14.0VulnerableOracle
cpe:2.3:a:oracle:retail_advanced_inventory_planning:15.0:*:*:*:*:*:*:*15.0VulnerableOracle
cpe:2.3:a:oracle:retail_clearance_optimization_engine:14.0.5:*:*:*:*:*:*:*14.0.5VulnerableOracle
cpe:2.3:a:oracle:retail_extract_transform_and_load:13.0:*:*:*:*:*:*:*13.0VulnerableOracle
cpe:2.3:a:oracle:retail_extract_transform_and_load:13.1:*:*:*:*:*:*:*13.1VulnerableOracle
cpe:2.3:a:oracle:retail_extract_transform_and_load:13.2:*:*:*:*:*:*:*13.2VulnerableOracle
cpe:2.3:a:oracle:retail_extract_transform_and_load:19.0:*:*:*:*:*:*:*19.0VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:14.0.0:*:*:*:*:*:*:*14.0.0VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:14.1.0:*:*:*:*:*:*:*14.1.0VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:15.0:*:*:*:*:*:*:*15.0VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:16.0:*:*:*:*:*:*:*16.0VulnerableOracle
cpe:2.3:a:oracle:retail_open_commerce_platform:5.3.0:*:*:*:*:*:*:*5.3.0VulnerableOracle
cpe:2.3:a:oracle:retail_open_commerce_platform:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableOracle
cpe:2.3:a:oracle:retail_open_commerce_platform:6.0.1:*:*:*:*:*:*:*6.0.1VulnerableOracle
cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3:*:*:*:*:*:*:*15.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_service_backbone:14.1:*:*:*:*:*:*:*14.1VulnerableOracle
cpe:2.3:a:oracle:retail_service_backbone:15.0:*:*:*:*:*:*:*15.0VulnerableOracle
cpe:2.3:a:oracle:retail_service_backbone:16.0:*:*:*:*:*:*:*16.0VulnerableOracle
cpe:2.3:a:oracle:siebel_ui_framework:18.7:*:*:*:*:*:*:*18.7VulnerableOracle
cpe:2.3:a:oracle:siebel_ui_framework:18.8:*:*:*:*:*:*:*18.8VulnerableOracle
cpe:2.3:a:oracle:siebel_ui_framework:18.9:*:*:*:*:*:*:*18.9VulnerableOracle
cpe:2.3:a:oracle:soa_suite:12.1.3.0.0:*:*:*:*:*:*:*12.1.3.0.0VulnerableOracle
cpe:2.3:a:oracle:soa_suite:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:soa_suite:12.2.2.0.0:*:*:*:*:*:*:*12.2.2.0.0VulnerableOracle
cpe:2.3:a:oracle:tape_library_acsls:8.4:*:*:*:*:*:*:*8.4VulnerableOracle
cpe:2.3:a:oracle:timesten_in-memory_database:11.2.2.8.49:*:*:*:*:*:*:*11.2.2.8.49VulnerableOracle
cpe:2.3:a:oracle:utilities_advanced_spatial_and_operational_analytics:2.7.0.1:*:*:*:*:*:*:*2.7.0.1VulnerableOracle
cpe:2.3:a:oracle:utilities_work_and_asset_management:1.9.1.2.12:*:*:*:*:*:*:*1.9.1.2.12VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*10.3.6.0.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*12.1.3.0.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*14.1.1.0.0VulnerableOracle
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:* Versions 7.5 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:* Versions 7.5 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:* Versions 11.1.2.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:* Versions 13.3.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:autovue_vuelink_integration:21.0.0:*:*:*:*:*:*:* Versions 21.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:autovue_vuelink_integration:21.0.1:*:*:*:*:*:*:* Versions 21.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:* Versions 2.6.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:bi_publisher:11.1.1.7.0:*:*:*:*:*:*:* Versions 11.1.1.7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:bi_publisher:11.1.1.9.0:*:*:*:*:*:*:* Versions 11.1.1.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:bi_publisher:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_converged_application_server_-_service_controller:6.1:*:*:*:*:*:*:* Versions 6.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.3.0:*:*:*:*:*:*:* Versions 10.0.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_interactive_session_recorder:*:*:*:*:*:*:*:* Versions 6.0 – 6.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_messaging_server:*:*:*:*:*:*:*:* Versions before 8.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_network_integrity:*:*:*:*:*:*:*:* Versions 7.3.2 – 7.3.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_online_mediation_controller:6.1:*:*:*:*:*:*:* Versions 6.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_pricing_design_center:11.1:*:*:*:*:*:*:* Versions 11.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_pricing_design_center:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_service_broker:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_webrtc_session_controller:*:*:*:*:*:*:*:* Versions before 7.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:configuration_manager:12.1.2.0.2:*:*:*:*:*:*:* Versions 12.1.2.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:configuration_manager:12.1.2.0.5:*:*:*:*:*:*:* Versions 12.1.2.0.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_data_quality:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_base_platform:12.1.0.5:*:*:*:*:*:*:* Versions 12.1.0.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2.0.0:*:*:*:*:*:*:* Versions 13.2.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_for_fusion_middleware:12.1.0.5:*:*:*:*:*:*:* Versions 12.1.0.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_for_fusion_middleware:13.2.0.0:*:*:*:*:*:*:* Versions 13.2.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_for_mysql_database:*:*:*:*:*:*:*:* Versions up to 13.2.2.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_for_oracle_database:12.1.0.8:*:*:*:*:*:*:* Versions 12.1.0.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_for_oracle_database:13.2.2:*:*:*:*:*:*:* Versions 13.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_for_peoplesoft:13.1.1.1:*:*:*:*:*:*:* Versions 13.1.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_for_peoplesoft:13.2.1.1:*:*:*:*:*:*:* Versions 13.2.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* Versions 7.3.3.0.0 – 7.3.3.0.2; 8.0.0.0.0 – 8.0.7.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_behavior_detection_platform:*:*:*:*:*:*:*:* Versions 8.0.0.0.0 – 8.0.4.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_behavior_detection_platform:6.1.1:*:*:*:*:*:*:* Versions 6.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:8.0.4:*:*:*:*:*:*:* Versions 8.0.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:8.0.5:*:*:*:*:*:*:* Versions 8.0.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_lending_and_leasing:*:*:*:*:*:*:*:* Versions 14.1.0 – 14.8.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_lending_and_leasing:12.5.0:*:*:*:*:*:*:* Versions 12.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.0.4:*:*:*:*:*:*:* Versions 8.0.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.0.5:*:*:*:*:*:*:* Versions 8.0.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_profitability_management:*:*:*:*:*:*:*:* Versions 8.0.0.0.0 – 8.0.7.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_profitability_management:6.1.1:*:*:*:*:*:*:* Versions 6.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_regulatory_reporting_with_agilereporter:8.0.9.2.0:*:*:*:*:*:*:* Versions 8.0.9.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_investor_servicing:12.0.4:*:*:*:*:*:*:* Versions 12.0.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_investor_servicing:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_investor_servicing:12.3.0:*:*:*:*:*:*:* Versions 12.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_investor_servicing:12.4.0:*:*:*:*:*:*:* Versions 12.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_investor_servicing:14.0.0:*:*:*:*:*:*:* Versions 14.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.2:*:*:*:*:*:*:* Versions 12.2.1.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.3:*:*:*:*:*:*:* Versions 12.2.1.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:goldengate:12.3.2.1.1:*:*:*:*:*:*:* Versions 12.3.2.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:goldengate_application_adapters:12.3.2.1.1:*:*:*:*:*:*:* Versions 12.3.2.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:identity_analytics:11.1.1.5.8:*:*:*:*:*:*:* Versions 11.1.1.5.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:identity_management_suite:11.1.2.3.0:*:*:*:*:*:*:* Versions 11.1.2.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:identity_management_suite:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:identity_manager_connector:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:in-memory_performance-driven_planning:12.1:*:*:*:*:*:*:* Versions 12.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:in-memory_performance-driven_planning:12.2:*:*:*:*:*:*:* Versions 12.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:instantis_enterprisetrack:*:*:*:*:*:*:*:* Versions 17.1 – 17.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_calculation_engine:10.1.1:*:*:*:*:*:*:* Versions 10.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_calculation_engine:10.2.1:*:*:*:*:*:*:* Versions 10.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_policy_administration:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_policy_administration:10.1:*:*:*:*:*:*:* Versions 10.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_policy_administration:10.2:*:*:*:*:*:*:* Versions 10.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_policy_administration:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_rules_palette:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_rules_palette:10.1:*:*:*:*:*:*:* Versions 10.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_rules_palette:10.2:*:*:*:*:*:*:* Versions 10.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_rules_palette:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_rules_palette:11.1:*:*:*:*:*:*:* Versions 11.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:4.0.1.0:*:*:*:*:*:*:* Versions 4.0.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:* Versions 11.1.1.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdeveloper:12.1.3.0.0:*:*:*:*:*:*:* Versions 12.1.3.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* Versions 3.4.0.0 – 3.4.7.4297; 4.0.0.0 – 4.0.4.5235; 8.0.0.0.0 – 8.0.0.8131 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_fin_install:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation:10.4.7:*:*:*:*:*:*:* Versions 10.4.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation:12.1.1:*:*:*:*:*:*:* Versions 12.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation:12.2.0:*:*:*:*:*:*:* Versions 12.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation:12.2.1:*:*:*:*:*:*:* Versions 12.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation:12.2.2:*:*:*:*:*:*:* Versions 12.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation:12.2.3:*:*:*:*:*:*:* Versions 12.2.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation:12.2.4:*:*:*:*:*:*:* Versions 12.2.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation:12.2.5:*:*:*:*:*:*:* Versions 12.2.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation:12.2.6:*:*:*:*:*:*:* Versions 12.2.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation:12.2.7:*:*:*:*:*:*:* Versions 12.2.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation:12.2.8:*:*:*:*:*:*:* Versions 12.2.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation:12.2.9:*:*:*:*:*:*:* Versions 12.2.9 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation:12.2.10:*:*:*:*:*:*:* Versions 12.2.10 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation_connector_for_siebel:10.4.6:*:*:*:*:*:*:* Versions 10.4.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation_for_mobile_devices:10.4.7:*:*:*:*:*:*:* Versions 10.4.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.1.1:*:*:*:*:*:*:* Versions 12.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.0:*:*:*:*:*:*:* Versions 12.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.1:*:*:*:*:*:*:* Versions 12.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.2:*:*:*:*:*:*:* Versions 12.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.3:*:*:*:*:*:*:* Versions 12.2.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.4:*:*:*:*:*:*:* Versions 12.2.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.5:*:*:*:*:*:*:* Versions 12.2.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.6:*:*:*:*:*:*:* Versions 12.2.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.7:*:*:*:*:*:*:* Versions 12.2.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.8:*:*:*:*:*:*:* Versions 12.2.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.9:*:*:*:*:*:*:* Versions 12.2.9 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.10:*:*:*:*:*:*:* Versions 12.2.10 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* Versions 16.2.0 – 16.2.11; 17.12.0 – 17.12.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:rapid_planning:12.1:*:*:*:*:*:*:* Versions 12.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:rapid_planning:12.2:*:*:*:*:*:*:* Versions 12.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.0:*:*:*:*:*:*:* Versions 14.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_advanced_inventory_planning:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_clearance_optimization_engine:14.0.5:*:*:*:*:*:*:* Versions 14.0.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_extract_transform_and_load:13.0:*:*:*:*:*:*:* Versions 13.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_extract_transform_and_load:13.1:*:*:*:*:*:*:* Versions 13.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_extract_transform_and_load:13.2:*:*:*:*:*:*:* Versions 13.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_extract_transform_and_load:19.0:*:*:*:*:*:*:* Versions 19.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:14.0.0:*:*:*:*:*:*:* Versions 14.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:14.1.0:*:*:*:*:*:*:* Versions 14.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_open_commerce_platform:5.3.0:*:*:*:*:*:*:* Versions 5.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_open_commerce_platform:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_open_commerce_platform:6.0.1:*:*:*:*:*:*:* Versions 6.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3:*:*:*:*:*:*:* Versions 15.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_service_backbone:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_service_backbone:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_service_backbone:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:siebel_ui_framework:18.7:*:*:*:*:*:*:* Versions 18.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:siebel_ui_framework:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:siebel_ui_framework:18.9:*:*:*:*:*:*:* Versions 18.9 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:soa_suite:12.1.3.0.0:*:*:*:*:*:*:* Versions 12.1.3.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:soa_suite:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:soa_suite:12.2.2.0.0:*:*:*:*:*:*:* Versions 12.2.2.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:tape_library_acsls:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:timesten_in-memory_database:11.2.2.8.49:*:*:*:*:*:*:* Versions 11.2.2.8.49 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_advanced_spatial_and_operational_analytics:2.7.0.1:*:*:*:*:*:*:* Versions 2.7.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_work_and_asset_management:1.9.1.2.12:*:*:*:*:*:*:* Versions 1.9.1.2.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:* Versions 10.3.6.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* Versions 12.1.3.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* Versions 14.1.1.0.0 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-fxph-q3j8-mv87 org.apache.logging.log4j:log4j (Maven) Fixed in 2.8.2 Advisory →
  • Fix · GHSA-fxph-q3j8-mv87 org.apache.logging.log4j:log4j-core (Maven) Fixed in 2.8.2 Advisory →

Red Hat 20 advisories

  • RHSA-2021:3140 Released 2021-08-11 · Red Hat rating Moderate
    Red Hat Fuse 7.9.0 release and security update
    • Red Hat Fuse 7.9
  • RHSA-2019:1545 Released 2019-06-18 · Red Hat rating Important
    Red Hat Fuse 7.3.1 security update
    • Red Hat Fuse 7.3.1
  • RHSA-2017:3399 Released 2017-12-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 5.2 security update
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server log4j-1.2.14-19.patch_01.ep5.el5
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server log4j-1.2.14-19.patch_01.ep5.el6
Show 17 more Red Hat advisories
  • RHSA-2017:3400 Released 2017-12-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 5.2 security update
    • Red Hat JBoss Enterprise Application Platform 5.2 security update
  • RHSA-2017:3244 Released 2017-11-16 · Red Hat rating Important
    Red Hat JBoss Data Grid 7.1.1 security update
    • Red Hat JBoss Data Grid 7.1
  • RHSA-2017:2889 Released 2017-10-12 · Red Hat rating Important
    Red Hat JBoss BPM Suite 6.4.6 security update
    • Red Hat JBoss BPMS 6.4
  • RHSA-2017:2888 Released 2017-10-12 · Red Hat rating Important
    Red Hat JBoss BRMS 6.4.6 security update
    • Red Hat JBoss BRMS 6.4
  • RHSA-2017:2811 Released 2017-09-26 · Red Hat rating Important
    eap7-jboss-ec2-eap security update
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-jboss-ec2-eap-7.0.8-1.GA_redhat_1.ep7.el6, eap7-jboss-ec2-eap-samples-7.0.8-1.GA_redhat_1.ep7.el6
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-jboss-ec2-eap-7.0.8-1.GA_redhat_1.ep7.el7, eap7-jboss-ec2-eap-samples-7.0.8-1.GA_redhat_1.ep7.el7
  • RHSA-2017:2809 Released 2017-09-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-artemis-native-1.1.0-13.redhat_4.ep7.el6, eap7-artemis-native-wildfly-1.1.0-13.redhat_4.ep7.el6, eap7-bouncycastle-1.56.0-3.redhat_2.2.ep7.el6 +31
  • RHSA-2017:2808 Released 2017-09-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-artemis-native-1.1.0-13.redhat_4.ep7.el7, eap7-artemis-native-wildfly-1.1.0-13.redhat_4.ep7.el7, eap7-bouncycastle-1.56.0-3.redhat_2.2.ep7.el7 +31
  • RHSA-2017:2810 Released 2017-09-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss EAP 7.0
  • RHSA-2017:2638 Released 2017-09-05 · Red Hat rating Important
    jboss-ec2-eap security, bug fix, and enhancement update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server jboss-ec2-eap-7.5.17-1.Final_redhat_4.ep6.el6, jboss-ec2-eap-samples-7.5.17-1.Final_redhat_4.ep6.el6
  • RHSA-2017:2635 Released 2017-09-05 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 6
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server apache-cxf-2.7.18-7.SP6_redhat_1.1.ep6.el6, codehaus-jackson-1.9.9-11.redhat_5.1.ep6.el6, codehaus-jackson-core-asl-1.9.9-11.redhat_5.1.ep6.el6 +47
  • RHSA-2017:2637 Released 2017-09-05 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 5
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server apache-cxf-2.7.18-7.SP6_redhat_1.1.ep6.el5, codehaus-jackson-1.9.9-11.redhat_5.1.ep6.el5, codehaus-jackson-core-asl-1.9.9-11.redhat_5.1.ep6.el5 +47
  • RHSA-2017:2636 Released 2017-09-05 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 7
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server apache-cxf-2.7.18-7.SP6_redhat_1.1.ep6.el7, codehaus-jackson-1.9.9-11.redhat_5.1.ep6.el7, codehaus-jackson-core-asl-1.9.9-11.redhat_5.1.ep6.el7 +47
  • RHSA-2017:2633 Released 2017-09-05 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.17 update
    • Red Hat JBoss Enterprise Application Platform 6.4
  • RHSA-2017:2423 Released 2017-08-07 · Red Hat rating Important
    log4j security update
    • Red Hat Enterprise Linux Client (v. 7) log4j-1.2.17-16.el7_4
    • Red Hat Enterprise Linux Client Optional (v. 7) log4j-javadoc-1.2.17-16.el7_4, log4j-manual-1.2.17-16.el7_4
    • Red Hat Enterprise Linux ComputeNode (v. 7) log4j-1.2.17-16.el7_4
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) log4j-javadoc-1.2.17-16.el7_4, log4j-manual-1.2.17-16.el7_4
    • Red Hat Enterprise Linux Server (v. 7) log4j-1.2.17-16.el7_4
    • Red Hat Enterprise Linux Server Optional (v. 7) log4j-javadoc-1.2.17-16.el7_4, log4j-manual-1.2.17-16.el7_4
    • Red Hat Enterprise Linux Workstation (v. 7) log4j-1.2.17-16.el7_4
    • Red Hat Enterprise Linux Workstation Optional (v. 7) log4j-javadoc-1.2.17-16.el7_4, log4j-manual-1.2.17-16.el7_4
  • RHSA-2017:1802 Released 2017-07-25 · Red Hat rating Important
    Red Hat JBoss Web Server Service Pack 1 security update
    • Red Hat JBoss Web Server 3.1
  • RHSA-2017:1801 Released 2017-07-25 · Red Hat rating Important
    Red Hat JBoss Web Server 3.1.0 Service Pack 1 security update
    • Red Hat JBoss Web Server 3.1 for RHEL 6 log4j-eap6-1.2.16-12.redhat_3.1.ep6.el6, tomcat-native-1.2.8-10.redhat_10.ep7.el6, tomcat7-7.0.70-22.ep7.el6 +23
    • Red Hat JBoss Web Server 3.1 for RHEL 7 log4j-eap6-1.2.16-12.redhat_3.1.ep6.el7, tomcat-native-1.2.8-10.redhat_10.ep7.el7, tomcat7-7.0.70-22.ep7.el7 +23
  • RHSA-2017:1417 Released 2017-06-08 · Red Hat rating Important
    rh-java-common-log4j security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-java-common-log4j-1.2.17-15.15.el6, rh-java-common-log4j-javadoc-1.2.17-15.15.el6, rh-java-common-log4j-manual-1.2.17-15.15.el6
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-java-common-log4j-1.2.17-15.15.el7, rh-java-common-log4j-javadoc-1.2.17-15.15.el7, rh-java-common-log4j-manual-1.2.17-15.15.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-java-common-log4j-1.2.17-15.15.el6, rh-java-common-log4j-javadoc-1.2.17-15.15.el6, rh-java-common-log4j-manual-1.2.17-15.15.el6
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-java-common-log4j-1.2.17-15.15.el7, rh-java-common-log4j-javadoc-1.2.17-15.15.el7, rh-java-common-log4j-manual-1.2.17-15.15.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-java-common-log4j-1.2.17-15.15.el6, rh-java-common-log4j-javadoc-1.2.17-15.15.el6, rh-java-common-log4j-manual-1.2.17-15.15.el6
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-java-common-log4j-1.2.17-15.15.el7, rh-java-common-log4j-javadoc-1.2.17-15.15.el7, rh-java-common-log4j-manual-1.2.17-15.15.el7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AMQ Broker 7AffectedNo fix yet
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Enterprise Virtualization 3AffectedNo fix planned: Will not fix
Red Hat JBoss A-MQ 6AffectedNo fix yet
Red Hat JBoss BRMS 5AffectedNo fix planned: Will not fix
Red Hat JBoss Data Grid 7AffectedNo fix yet
Red Hat JBoss Enterprise Web Server 2AffectedNo fix planned: Will not fix
Red Hat JBoss Fuse 6AffectedNo fix yet
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Will not fix
Red Hat JBoss SOA Platform 5AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2017:2423
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2017:2423
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2017:2423
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2017:2423
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2017:2423
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2017:2423
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2017:2423
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2017:2423
Red Hat Fuse 7.3.1Fixed RHSA-2019:1545
Red Hat Fuse 7.9Fixed RHSA-2021:3140
Red Hat JBoss BPMS 6.4Fixed RHSA-2017:2889
Red Hat JBoss BRMS 6.4Fixed RHSA-2017:2888
Red Hat JBoss Data Grid 7.1Fixed RHSA-2017:3244
Red Hat JBoss EAP 7.0Fixed RHSA-2017:2810
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 ServerFixed RHSA-2017:3399
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 ServerFixed RHSA-2017:3399
Red Hat JBoss Enterprise Application Platform 5.2 security updateFixed RHSA-2017:3400
Red Hat JBoss Enterprise Application Platform 6.4Fixed RHSA-2017:2633
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 ServerFixed RHSA-2017:2637
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 ServerFixed RHSA-2017:2635, RHSA-2017:2638
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 ServerFixed RHSA-2017:2636
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 ServerFixed RHSA-2017:2809, RHSA-2017:2811
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 ServerFixed RHSA-2017:2808, RHSA-2017:2811
Red Hat JBoss Web Server 3.1Fixed RHSA-2017:1802
Red Hat JBoss Web Server 3.1 for RHEL 6Fixed RHSA-2017:1801
Red Hat JBoss Web Server 3.1 for RHEL 7Fixed RHSA-2017:1801
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2017:1417
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2017:1417
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)Fixed RHSA-2017:1417
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)Fixed RHSA-2017:1417
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2017:1417
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2017:1417
Not affected: 7 products
  • Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational Tools
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Operations Network 3
  • Red Hat Mobile Application Platform 4
  • Red Hat OpenShift Enterprise 3
  • Red Hat Satellite 5
  • Red Hat Subscription Asset Manager

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-5645
  2. 2026-10-03 Alias added: GHSA-fxph-q3j8-mv87
  3. 2026-10-08 CISA SSVC decision points changed
  4. 2026-11-05 Fix available: Red Hat JBoss EAP 7.0 · Red Hat

References

Patch 8

Advisory 32

Other 83

  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
  • TI-2021-20393 Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack KEVCVSS 3.1CRITICAL 9.0
  • TI-2019-13113 Deserialization of untrusted data in Apache Log4j CVSS 3.1CRITICAL 9.8
  • TI-2022-07428 SQL injection in JDBC Appender in Apache Log4j V1 CVSS 3.1CRITICAL 9.8
  • TI-2022-07425 Deserialization of untrusted data in JMSSink in Apache Log4j 1.x CVSS 3.1HIGH 8.8
  • TI-2021-20283 Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration CVSS 3.1MEDIUM 6.6
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences