Details
Description
CVE-2019-17571 Detail
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17571
Attachments
Issue Links
- Dependent
-
KAFKA-13604 Add pluggable logging framework support
-
- Open
-
- is blocked by
-
KAFKA-10877 Instantiating loggers for every FetchContext causes low request handler idle pool ratio.
-
- Open
-
- is depended upon by
-
KAFKA-12399 Deprecate Log4J Appender KIP-719
-
- Resolved
-
- is duplicated by
-
KAFKA-13616 Log4j 1.X CVE-2022-23302/5/7 vulnerabilities
-
- Resolved
-
-
KAFKA-13729 Kafka Core Components and other projects (like broker) using older version of the log4j 1.x, need to update 2.x
-
- Resolved
-
-
KAFKA-13534 Upgrade Log4j to 2.15.0 - CVE-2021-44228
-
- Resolved
-
- is related to
-
KAFKA-13534 Upgrade Log4j to 2.15.0 - CVE-2021-44228
-
- Resolved
-
- relates to
-
KAFKA-16936 Upgrade slf4k to 2.0.9 and integrate "-Dslf4j.provider" to kafka script
-
- Open
-
-
KAFKA-13625 Fix inconsistency in dynamic application log levels
-
- In Progress
-
- links to
- mentioned in
-
Page Loading...