| Package | Affected versions | Patched versions |
|---|---|---|
| log4j:log4j | ≥ 1.2, ≤ 1.2.17 | |
| org.zenframework.z8.dependencies.commons:log4j-1.2.17 | = 2.0 | |
| bookkeeper | < 4.14.3 | 4.14.3 |
| log4j | ≤ 1.2.17 | |
| oncommand system manager | ≥ 3.0, ≤ 3.1.3 | |
| application testing suite | = 13.3.0.1 | |
| communications network integrity | ≥ 7.3.2, ≤ 7.3.6 | |
| endeca information discovery studio | = 3.2.0 | |
| financial services lending and leasing | = 12.5.0≥ 14.1.0, ≤ 14.8.0 | |
| mysql enterprise monitor | ≤ 8.0.29 | |
| primavera gateway | ≥ 16.2, ≤ 16.2.11≥ 17.12.0, ≤ 17.12.7 | |
| rapid planning | = 12.1= 12.2 | |
| retail extract transform and load | = 19.0 | |
| retail service backbone | = 14.1= 15.0= 16.0 | |
| weblogic server | = 10.3.6.0.0= 12.1.3.0.0= 12.2.1.3.0= 12.2.1.4.0= 14.1.1.0.0 |
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions 1.2 up to 1.2.17.
Users are advised to migrate to org.apache.logging.log4j:log4j-core.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free