Vulnerability · Published Mar 10, 2023 · Assigned by apache
CVE-2023-26464Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender
High 7.5
In plain English
A high-severity unsafe deserialization in Apache Log4j from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested) hashmap or hashtable (depending on which logging component is in use) to be processed could exhaust the available memory in the virtual machine and achieve Denial of Service when the object is deserialized. This issue affects Apache Log4j before 2. Affected users are recommended to update to Log4j 2.x. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | log4j:log4j | 2.0 | GHSA-vp98-w2p3-mv35 |
| Maven | org.apache.logging.log4j:log4j-core | 2.0 | GHSA-vp98-w2p3-mv35 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Log4j | 1.0.4 – before 2 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H