Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

log4j can let attackers execute code

CVE-2019-17571 · published 8 days ago
Summary

The log4j logging library used in several Java applications has a flaw that could let a malicious user run code on your server. This affects the log4j package and related components listed. Apply the latest patched version of log4j as soon as possible to close the risk.

What to do
  • Update root io.root.log4j:log4j to version 1.2.12-root.io.1.
  • Update debian apache-log4j1.2 to version 1.2.17-9.
  • Update log4j:log4j to version 1.2.14-aikido.5.
  • Update io.root.log4j:log4j to version 1.2.14-root.io.5.
  • Update log4j:log4j to version 1.2.14-aikido.6.
  • Update io.root.log4j:log4j to version 1.2.14-root.io.6.
  • Update apache bookkeeper to version 4.14.3 or later.
Affected software
Ecosystem VendorProductAffected versions
maven log4j log4j:log4j >= 1.2, <= 1.2.17
maven zenframework org.zenframework.z8.dependencies.commons:log4j-1.2.17 2.0
– apache log4j <= 1.2.17
cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*
– debian debian_linux 8.0
9.0
10.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
– canonical ubuntu_linux 18.04
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
– opensuse leap 15.1
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
– netapp oncommand_system_manager >= 3.0, <= 3.1.3
cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*
– netapp oncommand_workflow_automation All versions
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
– oracle application_testing_suite 13.3.0.1
cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*
– oracle communications_network_integrity >= 7.3.2, <= 7.3.6
cpe:2.3:a:oracle:communications_network_integrity:*:*:*:*:*:*:*:*
– oracle endeca_information_discovery_studio 3.2.0
cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:*:*:*:*:*:*:*
– oracle financial_services_lending_and_leasing >= 14.1.0, <= 14.8.0
12.5.0
cpe:2.3:a:oracle:financial_services_lending_and_leasing:*:*:*:*:*:*:*:*
– oracle mysql_enterprise_monitor <= 8.0.29
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*
– oracle primavera_gateway >= 16.2, <= 16.2.11
>= 17.12.0, <= 17.12.7
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*
– oracle rapid_planning 12.1
12.2
cpe:2.3:a:oracle:rapid_planning:12.1:*:*:*:*:*:*:*
– oracle retail_extract_transform_and_load 19.0
cpe:2.3:a:oracle:retail_extract_transform_and_load:19.0:*:*:*:*:*:*:*
– oracle retail_service_backbone 14.1
15.0
16.0
cpe:2.3:a:oracle:retail_service_backbone:14.1:*:*:*:*:*:*:*
– oracle weblogic_server 10.3.6.0.0
12.1.3.0.0
12.2.1.3.0
12.2.1.4.0
14.1.1.0.0
cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*
– apache bookkeeper < 4.14.3
cpe:2.3:a:apache:bookkeeper:*:*:*:*:*:*:*:*
Root:Maven root io.root.log4j:log4j < 1.2.12-root.io.1
Fix: upgrade to 1.2.12-root.io.1
Debian:12 debian apache-log4j1.2 < 1.2.17-9
Fix: upgrade to 1.2.17-9
Root:Maven – log4j:log4j < 1.2.14-aikido.5
< 1.2.14-aikido.6
Fix: upgrade to 1.2.14-aikido.5
Root:Maven – io.root.log4j:log4j < 1.2.14-root.io.5
< 1.2.14-root.io.6
Fix: upgrade to 1.2.14-root.io.5
Original advisory text
CVE-2019-17571 in log4j:log4j - Patched by Root
Root has patched CVE-2019-17571 in the log4j:log4j package for Root:Maven. Multiple fixed versions available.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
69% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published5 Oct 2026
Updated5 Oct 2026
First seen6 Mar 2026
Sources
GHSA-2qrg-x229-3v8q · GHSA
CVE-2019-17571 · NVD
ROOT-APP-MAVEN-CVE-2019-17571 · OSV
DEBIAN-CVE-2019-17571 · OSV
Track software like this
Free during beta