In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitr…

Overview

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Affected

• log4j >= 2.0, < 2.8.2
• oncommand_api_services
• oncommand_insight
• oncommand_workflow_automation
• service_level_manager
• snapcenter
• storage_automation_store
• fuse = 1.0
• enterprise_linux = 6.0
• enterprise_linux = 6.7
• enterprise_linux = 7.0
• enterprise_linux = 7.3
• enterprise_linux = 7.4
• enterprise_linux = 7.5
• enterprise_linux = 7.6
• enterprise_linux_desktop = 7.0
• enterprise_linux_server = 7.0
• enterprise_linux_server_aus = 7.4
• enterprise_linux_server_aus = 7.6
• enterprise_linux_server_eus = 7.4
• enterprise_linux_server_eus = 7.5
• enterprise_linux_server_eus = 7.6
• enterprise_linux_server_tus = 7.4
• enterprise_linux_server_tus = 7.6
• enterprise_linux_workstation = 7.0
• api_gateway = 11.1.2.4.0
• application_testing_suite = 13.3.0.1
• autovue_vuelink_integration = 21.0.0
• autovue_vuelink_integration = 21.0.1
• banking_platform = 2.6.0
• banking_platform = 2.6.1
• banking_platform = 2.6.2
• bi_publisher = 11.1.1.7.0
• bi_publisher = 11.1.1.9.0
• bi_publisher = 12.2.1.3.0
• bi_publisher = 12.2.1.4.0
• communications_converged_application_server_-_service_controller = 6.1
• communications_instant_messaging_server = 10.0.1.3.0
• communications_interactive_session_recorder >= 6.0, <= 6.2
• communications_messaging_server < 8.0.2
• communications_network_integrity >= 7.3.2, <= 7.3.6
• communications_online_mediation_controller = 6.1
• communications_pricing_design_center = 11.1
• communications_pricing_design_center = 12.0
• communications_service_broker = 6.0
• communications_webrtc_session_controller < 7.2
• configuration_manager = 12.1.2.0.2
• configuration_manager = 12.1.2.0.5
• endeca_information_discovery_studio = 3.2.0
• enterprise_data_quality = 12.2.1.3.0
• enterprise_manager_base_platform = 12.1.0.5
• enterprise_manager_base_platform = 13.2.0.0
• enterprise_manager_for_fusion_middleware = 12.1.0.5
• enterprise_manager_for_fusion_middleware = 13.2.0.0
• enterprise_manager_for_mysql_database <= 13.2.2.0.0
• enterprise_manager_for_oracle_database = 12.1.0.8
• enterprise_manager_for_oracle_database = 13.2.2
• enterprise_manager_for_peoplesoft = 13.1.1.1
• enterprise_manager_for_peoplesoft = 13.2.1.1
• financial_services_analytical_applications_infrastructure >= 7.3.3.0.0, <= 7.3.3.0.2
• financial_services_analytical_applications_infrastructure >= 8.0.0.0.0, <= 8.0.7.0.0
• financial_services_behavior_detection_platform >= 8.0.0.0.0, <= 8.0.4.0.0
• financial_services_behavior_detection_platform = 6.1.1
• financial_services_hedge_management_and_ifrs_valuations = 8.0.4
• financial_services_hedge_management_and_ifrs_valuations = 8.0.5
• financial_services_lending_and_leasing >= 14.1.0, <= 14.8.0
• financial_services_lending_and_leasing = 12.5.0
• financial_services_loan_loss_forecasting_and_provisioning = 8.0.4
• financial_services_loan_loss_forecasting_and_provisioning = 8.0.5
• financial_services_profitability_management >= 8.0.0.0.0, <= 8.0.7.0.0
• financial_services_profitability_management = 6.1.1
• financial_services_regulatory_reporting_with_agilereporter = 8.0.9.2.0
• flexcube_investor_servicing = 12.0.4
• flexcube_investor_servicing = 12.1.0
• flexcube_investor_servicing = 12.3.0
• flexcube_investor_servicing = 12.4.0
• flexcube_investor_servicing = 14.0.0
• fusion_middleware_mapviewer = 12.2.1.2
• fusion_middleware_mapviewer = 12.2.1.3
• goldengate = 12.3.2.1.1
• goldengate_application_adapters = 12.3.2.1.1
• identity_analytics = 11.1.1.5.8
• identity_management_suite = 11.1.2.3.0
• identity_management_suite = 12.2.1.3.0
• identity_manager_connector = 9.0
• in-memory_performance-driven_planning = 12.1
• in-memory_performance-driven_planning = 12.2
• instantis_enterprisetrack >= 17.1, <= 17.3
• insurance_calculation_engine = 10.1.1
• insurance_calculation_engine = 10.2.1
• insurance_policy_administration = 10.0
• insurance_policy_administration = 10.1
• insurance_policy_administration = 10.2
• insurance_policy_administration = 11.0
• insurance_rules_palette = 10.0
• insurance_rules_palette = 10.1
• insurance_rules_palette = 10.2
• insurance_rules_palette = 11.0
• insurance_rules_palette = 11.1
• jd_edwards_enterpriseone_tools = 4.0.1.0

Remediation

Upgrade past the affected range:

• log4j 2.8.2
• communications_messaging_server 8.0.2
• communications_webrtc_session_controller 7.2