vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2019-17571

CRITICAL
9.8
CVSS Score
Published: December 20, 2019 at 04:01 PM UTC
Updated: June 17, 2026 at 02:24 AM UTC
17 products affected across 6 vendorsDebian LinuxUbuntu LinuxLeap

Using Log4j by Apache Software Foundation?

Get instant alerts when new vulnerabilities affect Log4j - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
CRITICAL9.8
Exploit prediction
EPSS 70%
SSVC
No known exploit

Description

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Bookkeeper· Apache
95%
v < 4.14.3
Affected range stops below 4.14.3, so it looks safe — our inference, not a vendor statement
Log4j· Apachemaven
95%
v ≤ 1.2.17
Ubuntu Linux· Canonicalrubygems
95%
18.04
Debian Linux· Debiandrupal
95%
10.08.09.0
Oncommand System Manager· NetAppdrupal
95%
3.0 ≤ v ≤ 3.1.3
OnCommand Workflow Automation· NetApp
95%
All versions
Leap· openSUSEdrupal
95%
15.1
Application Testing Suite· Oracledrupal
95%
13.3.0.1
Communications Network Integrity· Oracle
95%
7.3.2 ≤ v ≤ 7.3.6
Endeca Information Discovery Studio· Oracle
95%
3.2.0

References (113)

Vendor Advisoryx_refsource_SUSEMailing ListThird Party Advisory
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00022.html
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1%40%3Cdev.tika.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c%40%3Cdev.tika.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6%40%3Cdev.tika.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/564f03b4e9511fcba29c68fc0299372dadbdb002718fa8edcc4325e4%40%3Cjira.kafka.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c%40%3Cissues.activemq.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/752ec92cd1e334a639e79bfbd689a4ec2c6579ec5bb41b53ffdf358d%40%3Cdev.kafka.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac%40%3Cissues.activemq.apache.org%3E

SSVC — Action Prioritization

SSVCNo known exploitAutomatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

9.8CRITICALCISA-ADP
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-502

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card