[ZOOKEEPER-4305] log4j CVE problem

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Duplicate
• Affects Version/s: 3.6.2
• Component/s: security
• Assignee: Unassigned
• Reporter: zhaozhengbin
• Created: 28/May/21 02:50
• Updated: 09/Oct/23 11:21
• Resolved: 28/May/21 15:27

Description

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data.this affects Log4j versions up to 1.2 up to 1.2.17.

Issue Links

• duplicates: ZOOKEEPER-3677 owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer