CVE-2017-5645 Apache Log4j
| Affected software | Apache Log4j |
|---|---|
| Severity | 9.8 Critical CVSS 3.1 2 scores |
| Fixed in | 2.8.2 |
| Weakness | Deserialization of untrusted data (CWE-502) |
| Published | 17 Apr 2017 |
| Updated | 13 Nov 2026 |
Description
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
Exploitation status
Working exploit published
A reviewed exploit catalogue lists ready-to-run exploit code for this CVE.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC 3 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2017-08-04.
- EPSS 89% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.8% of all scored CVEs.
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Deserialization
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE protected by the ARMR marshal Deserial rce rule, Deserial sys rule, Marshal RCE rule. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: ARMR marshal Deserial rce rule, Deserial sys rule, Marshal RCE rule
- The fix https://git-wip-us.apache.org/repos/asf?p=logging-log4j2.git;h=5dcc192
- ARMR marshal deserialization rce rule
How to mitigate CVE-2017-5645
Upgrade Apache Log4j to 2.8.2 or later. Until you can, Waratek RASP blocks exploitation with its deserialization rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
9.8 CRITICAL
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2 metrics
CVSS
9.8 CRITICAL v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 2.0 | 7.5 | none | AV:N/AC:L/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update October 2020 ↗ | CPU | 2020-Q4 | Oracle Financial Services Applications / Core (Apache Ant) (8.0.9.2.0) Oracle Fusion Middleware / General and Misc (Apache Log4j) (9.0) Oracle TimesTen In-Memory Database / Install (Apache Log4j) (Prior to 11.2.2.8.49) |
| Oracle Critical Patch Update July 2020 ↗ | CPU | 2020-Q3 | Oracle Communications Applications / Cartridge Management (Log4j) (7.3.2-7.3.6) Oracle Construction and Engineering / Admin (Apache Ant) (16.2.0-16.2.11, 17.12.0-17.12.7) Oracle Enterprise Manager / Load Testing for Web Apps (Log4j) (13.3.0.1) Oracle Financial Services Applications / Core (Log4j) (12.5.0, 14.1.0-14.8.0) Oracle Fusion Middleware / Centralized Thirdparty Jars (Log4j) (12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0) Oracle Fusion Middleware / Console (Log4j) (10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0) Oracle Fusion Middleware / Studio (Apache Ant) (3.2.0) Oracle Retail Applications / Installer (Log4j) (14.1, 15.0, 16.0) Oracle Retail Applications / Mathematical Operators (Log4j) (19.0) Oracle Supply Chain / Middle Tier (Apache Ant) (12.1, 12.2) Oracle Supply Chain / Middle Tier (Log4j) (12.1, 12.2) |
| Oracle Critical Patch Update April 2020 ↗ | CPU | 2020-Q2 | Oracle Construction and Engineering / Logging (Log4j) (17.1 - 17.3) Oracle Retail Applications / AIP Dashboard (Apache Ant) (14.0, 15.0) Oracle Supply Chain / User Interface (Log4j) (12.1, 12.2) |
| Oracle Critical Patch Update January 2020 ↗ | CPU | 2020-Q1 | Oracle Communications Applications / Core (Log4j) (10.0.1.3.0) |
| Oracle Critical Patch Update October 2019 ↗ | CPU | 2019-Q4 | Oracle JD Edwards / Deployment (Log4j) (4.0.1.0) |
| Oracle Critical Patch Update July 2019 ↗ | CPU | 2019-Q3 | Oracle Communications Applications / Security (Apache Log4j) (6.0, 6.1, 6.2) Oracle Fusion Middleware / Installation & Templates (Apache Log4j) (12.2.1.3.0) Oracle JD Edwards Products / Installation SEC (Apache Log4j) (9.2) Oracle Utilities Applications / Install (Apache Log4j) (2.7.0.1) |
| Oracle Critical Patch Update April 2019 ↗ | CPU | 2019-Q2 | Oracle Communications Applications / Security (Apache Log4j) (11.1, 12.0) Oracle Fusion Middleware / None (Apache Log4j) (11.1.1.9.0, 12.1.3.0.0, 12.2.1.3.0) Oracle JD Edwards Products / Monitoring and Diagnostics (Apache Log4j) (9.2) |
| Oracle Critical Patch Update January 2019 ↗ | CPU | 2019-Q1 | Oracle Communications Applications / Security (Apache Log4j) (6.0) Oracle Communications Applications / Security (Apache Log4j) (6.1) Oracle Communications Applications / Security (Apache Log4j) (6.1) Oracle Communications Applications / Security (Apache Log4j) (prior to 7.2) Oracle Financial Services Applications / Infrastructure (Apache Log4j) (12.0.4, 12.1.0, 12.3.0, 12.4.0, 14.0.0) Oracle Fusion Middleware / Application Adapters (Apache Log4j) (12.3.2.1.1) Oracle Fusion Middleware / Installation & Templates (Apache Log4j) (12.1.3.0.0, 12.2.1.3.0) Oracle Sun Systems Products Suite / Software (Apache Log4j) (8.4) |
| Oracle Critical Patch Update October 2018 ↗ | CPU | 2018-Q4 | Oracle Communications Applications / Convergence (Apache Log4J) (Prior to 8.0.2) Oracle Enterprise Manager Products Suite / Collector of Config and Diag (Apache Log4j) (12.1.2.0.2, 12.1.2.0.5) Oracle Fusion Middleware / BI Publisher Security (Apache Log4j) (11.1.1.7.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0) Oracle Fusion Middleware / Oracle API Gateway (Apache Log4j) (11.1.2.4.0) Oracle Fusion Middleware / Security (Apache Log4j) (11.1.1.5.8) Oracle Fusion Middleware / Suite Level Patch Issues (Apache Log4j) (11.1.2.3.0, 12.2.1.3.0) Oracle Insurance Applications / Calculation engine (Apache Log4j) (10.1.1, 10.2.1) Oracle Insurance Applications / Rules Palette (Apache Log4j) (10.0, 10.1, 10.2, 11.0, 11.1) Oracle Retail Applications / Framework (Apache Log4j) (5.3.0, 6.0.0, 6.0.1) Oracle Retail Applications / Mathematical Operators (Apache Log4j) (13.0, 13.1, 13.2) Oracle Siebel CRM / EAI (Apache Log4j) (18.7, 18.8, 18.9) |
| Oracle Critical Patch Update July 2018 ↗ | CPU | 2018-Q3 | Oracle Enterprise Manager Products Suite / Application Replay (Apache Log4j) (12.1.0.5, 13.2.x) Oracle Enterprise Manager Products Suite / EM Plugin: General (Apache Log4j) (13.2.2.0.0 and prior) Oracle Enterprise Manager Products Suite / FMW Plugin for CC (Apache Log4j) (12.1.0.5, 13.2.x) Oracle Enterprise Manager Products Suite / Installer (Apache Log4j) (12.1.0.5, 13.2.x) Oracle Enterprise Manager Products Suite / PSEM Plugin (Apache Log4j) (13.1.1.1, 13.2.1.1) Oracle Enterprise Manager Products Suite / Provisioning (Apache Log4j) (12.1.0.8, 13.2.2) Oracle Enterprise Manager Products Suite / Security Framework (Apache Log4j) (12.1.0.5, 13.2.x) Oracle Financial Services Applications / Collections (Apache Log4j) (2.6.0, 2.6.1, 2.6.2) Oracle Financial Services Applications / Infrastructure (Apache Log4j) (7.3.3.x, 8.0.x) Oracle's note: Please refer MOS document ( Doc ID 2380553.1) for applicability across other Oracle Financial Services products. Oracle Financial Services Applications / Ingestion (Apache Log4j) (8.0.x) Oracle Financial Services Applications / Logging (Apache Log4j) (6.1.1, 8.0.x) Oracle Financial Services Applications / Logging (Apache Log4j) (6.1.1, 8.0.x) Oracle Financial Services Applications / Logging (Apache Log4j) (8.0.4, 8.0.5) Oracle Financial Services Applications / Logging (Apache Log4j) (8.0.4, 8.0.5) Oracle Fusion Middleware / General (Apache Log4j) (12.2.1.3.0) Oracle Fusion Middleware / Install (Apache Log4j) (12.2.1.2, 12.2.1.3) Oracle Insurance Applications / Policy Administration (Apache Log4j) (10.0, 10.1, 10.2, 11.0) Oracle MySQL / Service Manager (Apache Log4j) (3.4.7.4297 and prior, 4.0.4.5235 and prior, 8.0.0.8131 and prior) Oracle PeopleSoft Products / Security (Apache Log4j) (9.2) Oracle Policy Automation / Core (Apache Log4j) (10.4.6) Oracle Policy Automation / Core (Apache Log4j) (10.4.7, 12.1.0, 12.1.1, 12.2.0, 12.2.1, 12.2.2, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.9, 12.2.10) Oracle Policy Automation / Determinations Engine (Apache Log4j) (10.4.7, 12.1.0, 12.1.1, 12.2.0, 12.2.1, 12.2.2, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.9, 12.2.10) Oracle Retail Applications / General Application (Apache Log4j) (14.0.5) Oracle Retail Applications / Install (Apache Log4j) (14.0.x, 14.1.x, 15.0.x, 16.0.x) Oracle Retail Applications / Installation (Apache Log4j) (12.0.x, 13.0.x, 13.1.x, 13.2.x, 14.0.x) Oracle Retail Applications / PeopleSoft Integration Bugs (Apache Log4j) (13.2.x, 14.0.x, 14.1.x, 15.0.x, 16.0.x, 16.0.x) Oracle Retail Applications / RIB Kernal (Apache Log4j) (12.0.x, 13.0.x, 13.1.x, 13.2.x, 14.0.0 14.1.0, 15.0, 16.0) Oracle Retail Applications / RPAS Fusion Client (Apache Log4j) (15.0.3) Oracle Supply Chain Products Suite / Installation Issues (Apache Log4j) (21.0.0, 21.0.1) Oracle Utilities Applications / Logging (Apache Log4j) (1.12.x, 2.3.x) Oracle Utilities Applications / Logging (Apache Log4j) (1.9.1.2.12) |
| Oracle Critical Patch Update April 2018 ↗ | CPU | 2018-Q2 | Oracle Communications Applications / Logging (Apache Log4j) (7.x) Oracle Communications Applications / Security (Apache Log4j) (7.3.x) Oracle Enterprise Manager Products Suite / Load Testing for Web Apps (Apache Log4j) (12.5.0.3, 13.1.0.1, 13.2.0.1) Oracle Enterprise Manager Products Suite / Networking (Apache Log4j) (12.2.2, 12.3.3) Oracle Financial Services Applications / Core (Apache Log4j) (12.0.0, 12.1.0) Oracle Financial Services Applications / Securities (Apache Log4j) (11.5.0, 11.6.0, 11.7.0) Oracle Fusion Middleware / Core Issues - 12c (Apache Log4j) (11.1.1.7.0, 12.1.3.0.0) Oracle Fusion Middleware / DAC Installation (Apache Log4j) (11.1.1.6.4) Oracle Fusion Middleware / Data Processing (Apache Log4j) (1.6.0) Oracle Fusion Middleware / Integrator Acquisition System (Apache Log4j) (3.1, 3.2) Oracle Fusion Middleware / MFT Runtime Server (Apache Log4j) (12.1.3.0.0, 12.2.1.2.0, 12.2.1.3.0) Oracle Fusion Middleware / Product Code (Apache Log4j) (7.7) Oracle Fusion Middleware / Security Framework (Apache Log4j) (12.2.1.2.0, 12.2.1.3.0) Oracle Fusion Middleware / Security Subsystem (Apache Log4j) (11.1.1.7.0, 12.1.3.0.0) Oracle Fusion Middleware / WL Diagnostics Framework (Apache Log4j) (10.3.6.0, 12.1.3.0, 12.2.1.2, 12.2.1.3) Oracle JD Edwards Products / Security Vulnerability (Apache Log4j) (A9.2, A9.3, A9.4) Oracle Retail Applications / Installation (Apache Log4j) (1.1.124, 15.0.1, 16.0.2) Oracle Retail Applications / Integration (Apache Log4j) (14.0, 14.1, 15.0, 16.0) Oracle Retail Applications / Operations & Maintenance (Apache Log4j) (13.2, 13.4, 14.1, 15.0) Oracle Retail Applications / SIM Integration (Apache Log4j) (12.0.12, 13.0.7, 13.1.9, 13.2.9, 14.0.4, 14.1.3, 15.0.2, 16.0.1) Oracle Retail Applications / Security (Apache Log4j) (12.0, 13.0, 13.1, 13.2, 14.0, 14.1, 15.0, 16.0) Oracle Retail Applications / Security (Apache Log4j) (12.0, 13.0, 13.1, 13.2, 14.0, 14.1, 15.0, 16.0) Oracle Retail Applications / Security (Apache Log4j) (14.0.4, 14.1.3) Oracle Retail Applications / Security (Apache Log4j) (14.0.4, 14.1.3) Oracle Retail Applications / Security (Apache Log4j) (14.0.4, 14.1.3) Oracle Retail Applications / Security (Apache Log4j) (2.3.8, 2.4.9, 14.0.4, 14.1.3) Oracle Retail Applications / Security (Apache Log4j) (2.9.5) Oracle Retail Applications / System Administration (Apache Log4j) (5.0, 5.1, 5.2, 15.0, 16.0) Oracle Retail Applications / Upgrade Install (Apache Log4j) (4.0, 4.5, 4.7, 5.0) Oracle Retail Applications / Xenvironment (Apache Log4j) (6.0.11, 7.0.6, 7.1.6, 15.0.1) Oracle Utilities Applications / Logging (Apache Log4j) (2.2.0, 4.2.0, 4.3.0) |
| Oracle Critical Patch Update January 2018 ↗ | CPU | 2018-Q1 | Oracle Communications Applications / Notifications Gateway (Apache Log4j) (6.0) Oracle Communications Applications / Notifications Gateway (Apache Log4j) (6.0) Oracle Communications Applications / Security (Apache Log4j) (5.1, 6.0) Oracle Communications Applications / Security (Apache Log4j) (7.5) Oracle Fusion Middleware / Sample apps (Apache Log4j) (10.3.6.0.0, 12.1.3.0.0, 12.2.1.2.0, 12.2.1.3.0) Oracle PeopleSoft Products / Supply Chain Portal Pack (Apache Log4j) (9.1) Oracle PeopleSoft Products / Supply Chain Portal Pack (Apache Log4j) (9.1) Oracle Retail Applications / Application Core (Apache Log4j) (14.1.3, 15.0.3, 16.0.1) Oracle Retail Applications / Configuration Issues (Apache Log4j) (1.60.7, 1.64.0) Oracle Retail Applications / Internal Operations (Apache Log4j) (10.8.x, 11.4.x) Oracle Retail Applications / Internal Operations (Apache Log4j) (16.0.x) Oracle Retail Applications / NF Issuing (Apache Log4j) (14.1) Oracle Retail Applications / OPT Server (Apache Log4j) (2.1.132) Oracle Retail Applications / Retail (Apache Log4j) (10.0.1, 10.5.0, 10.6.0, 10.7.0, 10.8.0, 10.8.1) Oracle Supply Chain Products Suite / Administration (Apache Log4j) (9.3.3, 9.3.4) Oracle Supply Chain Products Suite / Business Process Automation (Apache Log4j) (6.2.11, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.4.1) Oracle Supply Chain Products Suite / CAX Client (Apache Log4j) (3.3, 3.4, 3.5, 3.6) Oracle Supply Chain Products Suite / Importing and Exporting Data (Apache Log4j) (6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.4.1, 6.4.2) Oracle Supply Chain Products Suite / Internal Operations (Apache Log4j) (21.0.0, 21.0.1) Oracle Supply Chain Products Suite / Internal Operations (Apache Log4j) (6.1.3, 6.2.0, 6.2.1) Oracle Supply Chain Products Suite / Security (Apache Log4j) (9.3.3, 9.3.4, 9.3.5, 9.3.6) Oracle Virtualization / Core (Apache Log4j) (5.3) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications Applications | Cartridge Management (Log4j) | 7.3.2-7.3.6 | |
| Oracle Communications Applications | Convergence (Apache Log4J) | Prior to 8.0.2 | |
| Oracle Communications Applications | Core (Log4j) | 10.0.1.3.0 | 10.0.1.3.0 |
| Oracle Communications Applications | Logging (Apache Log4j) | 7.x | 7 |
| Oracle Communications Applications | Notifications Gateway (Apache Log4j) | 6.0 | 6.0 |
| Oracle Communications Applications | Security (Apache Log4j) | prior to 7.2 | 5.1 · 6.0 · 6.1 · 6.2 · 7.3 · 7.5 · 11.1 · 12.0 |
| Oracle Construction and Engineering | Admin (Apache Ant) | 16.2.0-16.2.11, 17.12.0-17.12.7 | |
| Oracle Construction and Engineering | Logging (Log4j) | 17.1 - 17.3 | |
| Oracle Enterprise Manager | Load Testing for Web Apps (Log4j) | 13.3.0.1 | 13.3.0.1 |
| Oracle Enterprise Manager Products Suite | Application Replay (Apache Log4j) | 12.1.0.5, 13.2.x | 12.1.0.5 · 13.2 |
| Oracle Enterprise Manager Products Suite | Collector of Config and Diag (Apache Log4j) | 12.1.2.0.2, 12.1.2.0.5 | 12.1.2.0.2 · 12.1.2.0.5 |
| Oracle Enterprise Manager Products Suite | EM Plugin: General (Apache Log4j) | 13.2.2.0.0 and prior | |
| Oracle Enterprise Manager Products Suite | FMW Plugin for CC (Apache Log4j) | 12.1.0.5, 13.2.x | 12.1.0.5 · 13.2 |
| Oracle Enterprise Manager Products Suite | Installer (Apache Log4j) | 12.1.0.5, 13.2.x | 12.1.0.5 · 13.2 |
| Oracle Enterprise Manager Products Suite | Load Testing for Web Apps (Apache Log4j) | 12.5.0.3, 13.1.0.1, 13.2.0.1 | 12.5.0.3 · 13.1.0.1 · 13.2.0.1 |
| Oracle Enterprise Manager Products Suite | Networking (Apache Log4j) | 12.2.2, 12.3.3 | 12.2.2 · 12.3.3 |
| Oracle Enterprise Manager Products Suite | PSEM Plugin (Apache Log4j) | 13.1.1.1, 13.2.1.1 | 13.1.1.1 · 13.2.1.1 |
| Oracle Enterprise Manager Products Suite | Provisioning (Apache Log4j) | 12.1.0.8, 13.2.2 | 12.1.0.8 · 13.2.2 |
| Oracle Enterprise Manager Products Suite | Security Framework (Apache Log4j) | 12.1.0.5, 13.2.x | 12.1.0.5 · 13.2 |
| Oracle Financial Services Applications | Collections (Apache Log4j) | 2.6.0, 2.6.1, 2.6.2 | 2.6.0 · 2.6.1 · 2.6.2 |
| Oracle Financial Services Applications | Core (Apache Ant) | 8.0.9.2.0 | 8.0.9.2.0 |
| Oracle Financial Services Applications | Core (Apache Log4j) | 12.0.0, 12.1.0 | 12.0.0 · 12.1.0 |
| Oracle Financial Services Applications | Core (Log4j) | 12.5.0, 14.1.0-14.8.0 | 12.5.0 |
| Oracle Financial Services Applications | Infrastructure (Apache Log4j) | 7.3.3.x, 8.0.x | 7.3.3 · 8.0 · 12.0.4 · 12.1.0 · 12.3.0 · 12.4.0 · 14.0.0 |
| Oracle Financial Services Applications | Ingestion (Apache Log4j) | 8.0.x | 8.0 |
| Oracle Financial Services Applications | Logging (Apache Log4j) | 6.1.1, 8.0.x | 6.1.1 · 8.0 · 8.0.4 · 8.0.5 |
| Oracle Financial Services Applications | Securities (Apache Log4j) | 11.5.0, 11.6.0, 11.7.0 | 11.5.0 · 11.6.0 · 11.7.0 |
| Oracle Fusion Middleware | Application Adapters (Apache Log4j) | 12.3.2.1.1 | 12.3.2.1.1 |
| Oracle Fusion Middleware | BI Publisher Security (Apache Log4j) | 11.1.1.7.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 | 11.1.1.7.0 · 11.1.1.9.0 · 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Fusion Middleware | Centralized Thirdparty Jars (Log4j) | 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 | 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0 |
| Oracle Fusion Middleware | Console (Log4j) | 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 | 10.3.6.0.0 · 12.1.3.0.0 · 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0 |
| Oracle Fusion Middleware | Core Issues - 12c (Apache Log4j) | 11.1.1.7.0, 12.1.3.0.0 | 11.1.1.7.0 · 12.1.3.0.0 |
| Oracle Fusion Middleware | DAC Installation (Apache Log4j) | 11.1.1.6.4 | 11.1.1.6.4 |
| Oracle Fusion Middleware | Data Processing (Apache Log4j) | 1.6.0 | 1.6.0 |
| Oracle Fusion Middleware | General (Apache Log4j) | 12.2.1.3.0 | 12.2.1.3.0 |
| Oracle Fusion Middleware | General and Misc (Apache Log4j) | 9.0 | 9.0 |
| Oracle Fusion Middleware | Install (Apache Log4j) | 12.2.1.2, 12.2.1.3 | 12.2.1.2 · 12.2.1.3 |
| Oracle Fusion Middleware | Installation & Templates (Apache Log4j) | 12.1.3.0.0, 12.2.1.3.0 | 12.1.3.0.0 · 12.2.1.3.0 |
| Oracle Fusion Middleware | Integrator Acquisition System (Apache Log4j) | 3.1, 3.2 | 3.1 · 3.2 |
| Oracle Fusion Middleware | MFT Runtime Server (Apache Log4j) | 12.1.3.0.0, 12.2.1.2.0, 12.2.1.3.0 | 12.1.3.0.0 · 12.2.1.2.0 · 12.2.1.3.0 |
| Oracle Fusion Middleware | None (Apache Log4j) | 11.1.1.9.0, 12.1.3.0.0, 12.2.1.3.0 | 11.1.1.9.0 · 12.1.3.0.0 · 12.2.1.3.0 |
| Oracle Fusion Middleware | Oracle API Gateway (Apache Log4j) | 11.1.2.4.0 | 11.1.2.4.0 |
| Oracle Fusion Middleware | Product Code (Apache Log4j) | 7.7 | 7.7 |
| Oracle Fusion Middleware | Sample apps (Apache Log4j) | 10.3.6.0.0, 12.1.3.0.0, 12.2.1.2.0, 12.2.1.3.0 | 10.3.6.0.0 · 12.1.3.0.0 · 12.2.1.2.0 · 12.2.1.3.0 |
| Oracle Fusion Middleware | Security (Apache Log4j) | 11.1.1.5.8 | 11.1.1.5.8 |
| Oracle Fusion Middleware | Security Framework (Apache Log4j) | 12.2.1.2.0, 12.2.1.3.0 | 12.2.1.2.0 · 12.2.1.3.0 |
| Oracle Fusion Middleware | Security Subsystem (Apache Log4j) | 11.1.1.7.0, 12.1.3.0.0 | 11.1.1.7.0 · 12.1.3.0.0 |
| Oracle Fusion Middleware | Studio (Apache Ant) | 3.2.0 | 3.2.0 |
| Oracle Fusion Middleware | Suite Level Patch Issues (Apache Log4j) | 11.1.2.3.0, 12.2.1.3.0 | 11.1.2.3.0 · 12.2.1.3.0 |
| Oracle Fusion Middleware | WL Diagnostics Framework (Apache Log4j) | 10.3.6.0, 12.1.3.0, 12.2.1.2, 12.2.1.3 | 10.3.6.0 · 12.1.3.0 · 12.2.1.2 · 12.2.1.3 |
| Oracle Insurance Applications | Calculation engine (Apache Log4j) | 10.1.1, 10.2.1 | 10.1.1 · 10.2.1 |
| Oracle Insurance Applications | Policy Administration (Apache Log4j) | 10.0, 10.1, 10.2, 11.0 | 10.0 · 10.1 · 10.2 · 11.0 |
| Oracle Insurance Applications | Rules Palette (Apache Log4j) | 10.0, 10.1, 10.2, 11.0, 11.1 | 10.0 · 10.1 · 10.2 · 11.0 · 11.1 |
| Oracle JD Edwards | Deployment (Log4j) | 4.0.1.0 | 4.0.1.0 |
| Oracle JD Edwards Products | Installation SEC (Apache Log4j) | 9.2 | 9.2 |
| Oracle JD Edwards Products | Monitoring and Diagnostics (Apache Log4j) | 9.2 | 9.2 |
| Oracle JD Edwards Products | Security Vulnerability (Apache Log4j) | A9.2, A9.3, A9.4 | |
| Oracle MySQL | Service Manager (Apache Log4j) | 3.4.7.4297 and prior, 4.0.4.5235 and prior, 8.0.0.8131 and prior | |
| Oracle PeopleSoft Products | Security (Apache Log4j) | 9.2 | 9.2 |
| Oracle PeopleSoft Products | Supply Chain Portal Pack (Apache Log4j) | 9.1 | 9.1 |
| Oracle Policy Automation | Core (Apache Log4j) | 10.4.6 | 10.4.6 · 10.4.7 · 12.1.0 · 12.1.1 · 12.2.0 · 12.2.1 · 12.2.2 · 12.2.3 · 12.2.4 · 12.2.5 · 12.2.6 · 12.2.7 · 12.2.8 · 12.2.9 · 12.2.10 |
| Oracle Policy Automation | Determinations Engine (Apache Log4j) | 10.4.7, 12.1.0, 12.1.1, 12.2.0, 12.2.1, 12.2.2, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.9, 12.2.10 | 10.4.7 · 12.1.0 · 12.1.1 · 12.2.0 · 12.2.1 · 12.2.2 · 12.2.3 · 12.2.4 · 12.2.5 · 12.2.6 · 12.2.7 · 12.2.8 · 12.2.9 · 12.2.10 |
| Oracle Retail Applications | AIP Dashboard (Apache Ant) | 14.0, 15.0 | 14.0 · 15.0 |
| Oracle Retail Applications | Application Core (Apache Log4j) | 14.1.3, 15.0.3, 16.0.1 | 14.1.3 · 15.0.3 · 16.0.1 |
| Oracle Retail Applications | Configuration Issues (Apache Log4j) | 1.60.7, 1.64.0 | 1.60.7 · 1.64.0 |
| Oracle Retail Applications | Framework (Apache Log4j) | 5.3.0, 6.0.0, 6.0.1 | 5.3.0 · 6.0.0 · 6.0.1 |
| Oracle Retail Applications | General Application (Apache Log4j) | 14.0.5 | 14.0.5 |
| Oracle Retail Applications | Install (Apache Log4j) | 14.0.x, 14.1.x, 15.0.x, 16.0.x | 14.0 · 14.1 · 15.0 · 16.0 |
| Oracle Retail Applications | Installation (Apache Log4j) | 1.1.124, 15.0.1, 16.0.2 | 1.1.124 · 12.0 · 13.0 · 13.1 · 13.2 · 14.0 · 15.0.1 · 16.0.2 |
| Oracle Retail Applications | Installer (Log4j) | 14.1, 15.0, 16.0 | 14.1 · 15.0 · 16.0 |
| Oracle Retail Applications | Integration (Apache Log4j) | 14.0, 14.1, 15.0, 16.0 | 14.0 · 14.1 · 15.0 · 16.0 |
| Oracle Retail Applications | Internal Operations (Apache Log4j) | 10.8.x, 11.4.x | 10.8 · 11.4 · 16.0 |
| Oracle Retail Applications | Mathematical Operators (Apache Log4j) | 13.0, 13.1, 13.2 | 13.0 · 13.1 · 13.2 |
| Oracle Retail Applications | Mathematical Operators (Log4j) | 19.0 | 19.0 |
| Oracle Retail Applications | NF Issuing (Apache Log4j) | 14.1 | 14.1 |
| Oracle Retail Applications | OPT Server (Apache Log4j) | 2.1.132 | 2.1.132 |
| Oracle Retail Applications | Operations & Maintenance (Apache Log4j) | 13.2, 13.4, 14.1, 15.0 | 13.2 · 13.4 · 14.1 · 15.0 |
| Oracle Retail Applications | PeopleSoft Integration Bugs (Apache Log4j) | 13.2.x, 14.0.x, 14.1.x, 15.0.x, 16.0.x, 16.0.x | 13.2 · 14.0 · 14.1 · 15.0 · 16.0 |
| Oracle Retail Applications | RIB Kernal (Apache Log4j) | 12.0.x, 13.0.x, 13.1.x, 13.2.x, 14.0.0 14.1.0, 15.0, 16.0 | 12.0 · 13.0 · 13.1 · 13.2 · 14.0.0.14.1.0 · 15.0 · 16.0 |
| Oracle Retail Applications | RPAS Fusion Client (Apache Log4j) | 15.0.3 | 15.0.3 |
| Oracle Retail Applications | Retail (Apache Log4j) | 10.0.1, 10.5.0, 10.6.0, 10.7.0, 10.8.0, 10.8.1 | 10.0.1 · 10.5.0 · 10.6.0 · 10.7.0 · 10.8.0 · 10.8.1 |
| Oracle Retail Applications | SIM Integration (Apache Log4j) | 12.0.12, 13.0.7, 13.1.9, 13.2.9, 14.0.4, 14.1.3, 15.0.2, 16.0.1 | 12.0.12 · 13.0.7 · 13.1.9 · 13.2.9 · 14.0.4 · 14.1.3 · 15.0.2 · 16.0.1 |
| Oracle Retail Applications | Security (Apache Log4j) | 2.3.8, 2.4.9, 14.0.4, 14.1.3 | 2.3.8 · 2.4.9 · 2.9.5 · 12.0 · 13.0 · 13.1 · 13.2 · 14.0 · 14.0.4 · 14.1 · 14.1.3 · 15.0 · 16.0 |
| Oracle Retail Applications | System Administration (Apache Log4j) | 5.0, 5.1, 5.2, 15.0, 16.0 | 5.0 · 5.1 · 5.2 · 15.0 · 16.0 |
| Oracle Retail Applications | Upgrade Install (Apache Log4j) | 4.0, 4.5, 4.7, 5.0 | 4.0 · 4.5 · 4.7 · 5.0 |
| Oracle Retail Applications | Xenvironment (Apache Log4j) | 6.0.11, 7.0.6, 7.1.6, 15.0.1 | 6.0.11 · 7.0.6 · 7.1.6 · 15.0.1 |
| Oracle Siebel CRM | EAI (Apache Log4j) | 18.7, 18.8, 18.9 | 18.7 · 18.8 · 18.9 |
| Oracle Sun Systems Products Suite | Software (Apache Log4j) | 8.4 | 8.4 |
| Oracle Supply Chain | Middle Tier (Apache Ant) | 12.1, 12.2 | 12.1 · 12.2 |
| Oracle Supply Chain | Middle Tier (Log4j) | 12.1, 12.2 | 12.1 · 12.2 |
| Oracle Supply Chain | User Interface (Log4j) | 12.1, 12.2 | 12.1 · 12.2 |
| Oracle Supply Chain Products Suite | Administration (Apache Log4j) | 9.3.3, 9.3.4 | 9.3.3 · 9.3.4 |
| Oracle Supply Chain Products Suite | Business Process Automation (Apache Log4j) | 6.2.11, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.4.1 | 6.2.11 · 6.3.1 · 6.3.2 · 6.3.3 · 6.3.4 · 6.3.5 · 6.3.6 · 6.3.7 · 6.4.1 |
| Oracle Supply Chain Products Suite | CAX Client (Apache Log4j) | 3.3, 3.4, 3.5, 3.6 | 3.3 · 3.4 · 3.5 · 3.6 |
| Oracle Supply Chain Products Suite | Importing and Exporting Data (Apache Log4j) | 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.4.1, 6.4.2 | 6.3.3 · 6.3.4 · 6.3.5 · 6.3.6 · 6.3.7 · 6.4.1 · 6.4.2 |
| Oracle Supply Chain Products Suite | Installation Issues (Apache Log4j) | 21.0.0, 21.0.1 | 21.0.0 · 21.0.1 |
| Oracle Supply Chain Products Suite | Internal Operations (Apache Log4j) | 6.1.3, 6.2.0, 6.2.1 | 6.1.3 · 6.2.0 · 6.2.1 · 21.0.0 · 21.0.1 |
| Oracle Supply Chain Products Suite | Security (Apache Log4j) | 9.3.3, 9.3.4, 9.3.5, 9.3.6 | 9.3.3 · 9.3.4 · 9.3.5 · 9.3.6 |
| Oracle TimesTen In-Memory Database | Install (Apache Log4j) | Prior to 11.2.2.8.49 | |
| Oracle Utilities Applications | Install (Apache Log4j) | 2.7.0.1 | 2.7.0.1 |
| Oracle Utilities Applications | Logging (Apache Log4j) | 1.9.1.2.12 | 1.9.1.2.12 · 1.12 · 2.2.0 · 2.3 · 4.2.0 · 4.3.0 |
| Oracle Virtualization | Core (Apache Log4j) | 5.3 | 5.3 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.logging.log4j:log4j |
2.0 | 2.8.2 |
unbounded |
org.apache.logging.log4j:log4j-core |
2.0 | 2.8.2 |
unbounded |
Products and versions
81 products, 176 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | log4j | generic | ≥ 2.0 and ＜ 2.8.2 |
| nvd | netapp | oncommand api services | generic | any version |
| nvd | netapp | oncommand insight | generic | any version |
| nvd | netapp | oncommand workflow automation | generic | any version |
| nvd | netapp | service level manager | generic | any version |
| nvd | netapp | snapcenter | generic | any version |
| nvd | netapp | storage automation store | generic | any version |
| nvd | oracle | api gateway | generic | 11.1.2.4.0 |
| nvd | oracle | application testing suite | generic | 13.3.0.1 |
| nvd | oracle | autovue vuelink integration | generic | 21.0.0 · 21.0.1 |
| nvd | oracle | banking platform | generic | 2.6.0 · 2.6.1 · 2.6.2 |
| nvd | oracle | bi publisher | generic | 11.1.1.7.0 · 11.1.1.9.0 · 12.2.1.3.0 · 12.2.1.4.0 |
| nvd | oracle | communications converged application server - service controller | generic | 6.1 |
| nvd | oracle | communications instant messaging server | generic | 10.0.1.3.0 |
| nvd | oracle | communications interactive session recorder | generic | ≥ 6.0 and ≤ 6.2 |
| nvd | oracle | communications messaging server | generic | ＜ 8.0.2 |
| nvd | oracle | communications network integrity | generic | ≥ 7.3.2 and ≤ 7.3.6 |
| nvd | oracle | communications online mediation controller | generic | 6.1 |
| nvd | oracle | communications pricing design center | generic | 11.1 · 12.0 |
| nvd | oracle | communications service broker | generic | 6.0 |
| nvd | oracle | communications webrtc session controller | generic | ＜ 7.2 |
| nvd | oracle | configuration manager | generic | 12.1.2.0.2 · 12.1.2.0.5 |
| nvd | oracle | endeca information discovery studio | generic | 3.2.0 |
| nvd | oracle | enterprise data quality | generic | 12.2.1.3.0 |
| nvd | oracle | enterprise manager base platform | generic | 12.1.0.5 · 13.2.0.0 |
| nvd | oracle | enterprise manager for fusion middleware | generic | 12.1.0.5 · 13.2.0.0 |
| nvd | oracle | enterprise manager for mysql database | generic | ≤ 13.2.2.0.0 |
| nvd | oracle | enterprise manager for oracle database | generic | 12.1.0.8 · 13.2.2 |
| nvd | oracle | enterprise manager for peoplesoft | generic | 13.1.1.1 · 13.2.1.1 |
| nvd | oracle | financial services analytical applications infrastructure | generic | ≥ 7.3.3.0.0 and ≤ 7.3.3.0.2 · ≥ 8.0.0.0.0 and ≤ 8.0.7.0.0 |
| nvd | oracle | financial services behavior detection platform | generic | 6.1.1 · ≥ 8.0.0.0.0 and ≤ 8.0.4.0.0 |
| nvd | oracle | financial services hedge management and ifrs valuations | generic | 8.0.4 · 8.0.5 |
| nvd | oracle | financial services lending and leasing | generic | 12.5.0 · ≥ 14.1.0 and ≤ 14.8.0 |
| nvd | oracle | financial services loan loss forecasting and provisioning | generic | 8.0.4 · 8.0.5 |
| nvd | oracle | financial services profitability management | generic | 6.1.1 · ≥ 8.0.0.0.0 and ≤ 8.0.7.0.0 |
| nvd | oracle | financial services regulatory reporting with agilereporter | generic | 8.0.9.2.0 |
| nvd | oracle | flexcube investor servicing | generic | 12.0.4 · 12.1.0 · 12.3.0 · 12.4.0 · 14.0.0 |
| nvd | oracle | fusion middleware mapviewer | generic | 12.2.1.2 · 12.2.1.3 |
| nvd | oracle | goldengate | generic | 12.3.2.1.1 |
| nvd | oracle | goldengate application adapters | generic | 12.3.2.1.1 |
| nvd | oracle | identity analytics | generic | 11.1.1.5.8 |
| nvd | oracle | identity management suite | generic | 11.1.2.3.0 · 12.2.1.3.0 |
| nvd | oracle | identity manager connector | generic | 9.0 |
| nvd | oracle | in-memory performance-driven planning | generic | 12.1 · 12.2 |
| nvd | oracle | instantis enterprisetrack | generic | ≥ 17.1 and ≤ 17.3 |
| nvd | oracle | insurance calculation engine | generic | 10.1.1 · 10.2.1 |
| nvd | oracle | insurance policy administration | generic | 10.0 · 10.1 · 10.2 · 11.0 |
| nvd | oracle | insurance rules palette | generic | 10.0 · 10.1 · 10.2 · 11.0 · 11.1 |
| nvd | oracle | jd edwards enterpriseone tools | generic | 4.0.1.0 · 9.2 |
| nvd | oracle | jdeveloper | generic | 11.1.1.9.0 · 12.1.3.0.0 · 12.2.1.3.0 |
| nvd | oracle | mysql enterprise monitor | generic | ≥ 3.4.0.0 and ≤ 3.4.7.4297 · ≥ 4.0.0.0 and ≤ 4.0.4.5235 · ≥ 8.0.0.0.0 and ≤ 8.0.0.8131 |
| nvd | oracle | peoplesoft enterprise fin install | generic | 9.2 |
| nvd | oracle | policy automation | generic | 10.4.7 · 12.1.0 · 12.1.1 · 12.2.0 · 12.2.1 · 12.2.2 · 12.2.3 · 12.2.4 · 12.2.5 · 12.2.6 · 12.2.7 · 12.2.8 · 12.2.9 · 12.2.10 |
| nvd | oracle | policy automation connector for siebel | generic | 10.4.6 |
| nvd | oracle | policy automation for mobile devices | generic | 10.4.7 · 12.1.0 · 12.1.1 · 12.2.0 · 12.2.1 · 12.2.2 · 12.2.3 · 12.2.4 · 12.2.5 · 12.2.6 · 12.2.7 · 12.2.8 · 12.2.9 · 12.2.10 |
| nvd | oracle | primavera gateway | generic | ≥ 16.2.0 and ≤ 16.2.11 · ≥ 17.12.0 and ≤ 17.12.7 |
| nvd | oracle | rapid planning | generic | 12.1 · 12.2 |
| nvd | oracle | retail advanced inventory planning | generic | 14.0 · 15.0 |
| nvd | oracle | retail clearance optimization engine | generic | 14.0.5 |
| nvd | oracle | retail extract transform and load | generic | 13.0 · 13.1 · 13.2 · 19.0 |
| nvd | oracle | retail integration bus | generic | 14.0.0 · 14.1.0 · 15.0 · 16.0 |
| nvd | oracle | retail open commerce platform | generic | 5.3.0 · 6.0.0 · 6.0.1 |
| nvd | oracle | retail predictive application server | generic | 15.0.3 |
| nvd | oracle | retail service backbone | generic | 14.1 · 15.0 · 16.0 |
| nvd | oracle | siebel ui framework | generic | 18.7 · 18.8 · 18.9 |
| nvd | oracle | soa suite | generic | 12.1.3.0.0 · 12.2.1.3.0 · 12.2.2.0.0 |
| nvd | oracle | tape library acsls | generic | 8.4 |
| nvd | oracle | timesten in-memory database | generic | 11.2.2.8.49 |
| nvd | oracle | utilities advanced spatial and operational analytics | generic | 2.7.0.1 |
| nvd | oracle | utilities work and asset management | generic | 1.9.1.2.12 |
| nvd | oracle | weblogic server | generic | 10.3.6.0.0 · 12.1.3.0.0 · 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0 |
| osv | org.apache.logging.log4j | log4j | generic | ≥ 2.0 and ＜ 2.8.2 |
| osv | org.apache.logging.log4j | log4j-core | generic | ≥ 2.0 and ＜ 2.8.2 |
| nvd | redhat | enterprise linux | generic | 6.0 · 6.7 · 7.0 · 7.3 · 7.4 · 7.5 · 7.6 |
| nvd | redhat | enterprise linux desktop | generic | 7.0 |
| nvd | redhat | enterprise linux server | generic | 7.0 |
| nvd | redhat | enterprise linux server aus | generic | 7.4 · 7.6 |
| nvd | redhat | enterprise linux server eus | generic | 7.4 · 7.5 · 7.6 |
| nvd | redhat | enterprise linux server tus | generic | 7.4 · 7.6 |
| nvd | redhat | enterprise linux workstation | generic | 7.0 |
| nvd | redhat | fuse | generic | 1.0 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** LOG4J, PROVISIONING (APACHE LOG4J), STUDIO (APACHE ANT), IMPORTING AND EXPORTING DATA (APACHE LOG4J), ADMINISTRATION (APACHE LOG4J), SAMPLE APPS (APACHE LOG4J), CORE (APACHE ANT), TCP/UDP, ADMIN (APACHE ANT), INSTALLER (APACHE LOG4J), MIDDLE TIER (APACHE ANT), GENERAL AND MISC (APACHE LOG4J), APPLICATION REPLAY (APACHE LOG4J), EAI (APACHE LOG4J), INTERNAL OPERATIONS (APACHE LOG4J), RETAIL (APACHE LOG4J), CENTRALIZED THIRDPARTY JARS (LOG4J), DEPLOYMENT (LOG4J), CORE ISSUES - 12C (APACHE LOG4J), LOAD TESTING FOR WEB APPS (APACHE LOG4J), PRODUCT CODE (APACHE LOG4J), NF ISSUING (APACHE LOG4J), INFRASTRUCTURE (APACHE LOG4J), HTTP, LOAD TESTING FOR WEB APPS (LOG4J), XENVIRONMENT (APACHE LOG4J), TCP, SOFTWARE (APACHE LOG4J), FRAMEWORK (APACHE LOG4J), SECURITY VULNERABILITY (APACHE LOG4J), RULES PALETTE (APACHE LOG4J), LOGGING (LOG4J), SECURITY FRAMEWORK (APACHE LOG4J), FMW PLUGIN FOR CC (APACHE LOG4J), BI PUBLISHER SECURITY (APACHE LOG4J), OPT SERVER (APACHE LOG4J), CORE (LOG4J), WL DIAGNOSTICS FRAMEWORK (APACHE LOG4J), RIB KERNAL (APACHE LOG4J), XMPP, CONFIGURATION ISSUES (APACHE LOG4J), MATHEMATICAL OPERATORS (LOG4J), AIP DASHBOARD (APACHE ANT), DETERMINATIONS ENGINE (APACHE LOG4J), INTEGRATOR ACQUISITION SYSTEM (APACHE LOG4J), CAX CLIENT (APACHE LOG4J), INSTALLATION (APACHE LOG4J), SUPPLY CHAIN PORTAL PACK (APACHE LOG4J), INSTALLATION & TEMPLATES (APACHE LOG4J), APPLICATION CORE (APACHE LOG4J), PSEM PLUGIN (APACHE LOG4J), INSTALL (APACHE LOG4J), NONE (APACHE LOG4J), INSTALLATION SEC (APACHE LOG4J), NETWORKING (APACHE LOG4J), INTEGRATION (APACHE LOG4J), SECURITY (APACHE LOG4J), SECURITIES (APACHE LOG4J), DATA PROCESSING (APACHE LOG4J), NO AUTH REMOTE EXPLOIT, INSTALLER (LOG4J), SUITE LEVEL PATCH ISSUES (APACHE LOG4J), POLICY ADMINISTRATION (APACHE LOG4J), SYSTEM ADMINISTRATION (APACHE LOG4J), APPLICATION ADAPTERS (APACHE LOG4J), CONVERGENCE (APACHE LOG4J), GENERAL (APACHE LOG4J), INSTALLATION ISSUES (APACHE LOG4J), RPAS FUSION CLIENT (APACHE LOG4J), PEOPLESOFT INTEGRATION BUGS (APACHE LOG4J), EM PLUGIN: GENERAL (APACHE LOG4J), SEE NOTE 1, UPGRADE INSTALL (APACHE LOG4J), USER INTERFACE (LOG4J), SIM INTEGRATION (APACHE LOG4J), ORACLE API GATEWAY (APACHE LOG4J), COLLECTIONS (APACHE LOG4J), SERVICE MANAGER (APACHE LOG4J), BUSINESS PROCESS AUTOMATION (APACHE LOG4J), MATHEMATICAL OPERATORS (APACHE LOG4J), INGESTION (APACHE LOG4J), CONSOLE (LOG4J), MULTIPLE, LOGGING (APACHE LOG4J), CARTRIDGE MANAGEMENT (LOG4J), DAC INSTALLATION (APACHE LOG4J), GENERAL APPLICATION (APACHE LOG4J), CALCULATION ENGINE (APACHE LOG4J), NOTIFICATIONS GATEWAY (APACHE LOG4J), SECURITY SUBSYSTEM (APACHE LOG4J), MIDDLE TIER (LOG4J), OPERATIONS & MAINTENANCE (APACHE LOG4J), MFT RUNTIME SERVER (APACHE LOG4J), COLLECTOR OF CONFIG AND DIAG (APACHE LOG4J), CORE (APACHE LOG4J), MONITORING AND DIAGNOSTICS (APACHE LOG4J) **Products:** ORACLE ENTERPRISE MANAGER, ORACLE FINANCIAL SERVICES LENDING AND LEASING, ORACLE COMMUNICATIONS ONLINE MEDIATION CONTROLLER, ORACLE RETAIL CLEARANCE OPTIMIZATION ENGINE, SIEBEL UI FRAMEWORK, ORACLE COMMUNICATIONS INSTANT MESSAGING SERVER, ORACLE MYSQL, ORACLE RETAIL EFTLINK, ORACLE AUTOVUE FOR AGILE PRODUCT LIFECYCLE MANAGEMENT, ORACLE FINANCIAL SERVICES ANALYTICAL APPLICATIONS INFRASTRUCTURE, MICROS LUCAS, TAPE LIBRARY ACSLS, ORACLE IDENTITY ANALYTICS, LOG4J, ENTERPRISE MANAGER FOR MYSQL DATABASE, ORACLE INSURANCE APPLICATIONS, ORACLE COMMUNICATIONS NETWORK CHARGING AND CONTROL, ORACLE COMMUNICATIONS INTERACTIVE SESSION RECORDER, ORACLE COMMUNICATIONS BRM - ELASTIC CHARGING ENGINE, AGILE MATERIAL AND EQUIPMENT MANAGEMENT FOR PHARMACEUTICALS, ORACLE VIRTUALIZATION, ORACLE TIMESTEN IN-MEMORY DATABASE, ORACLE FUSION MIDDLEWARE, ORACLE BIG DATA DISCOVERY, ORACLE RETAIL ADVANCED INVENTORY PLANNING, ORACLE FUSION MIDDLEWARE MAPVIEWER, ORACLE COMMUNICATIONS CONVERGED APPLICATION SERVER - SERVICE CONTROLLER, ORACLE SUPPLY CHAIN PRODUCTS SUITE, JD EDWARDS WORLD SECURITY, ENTERPRISE MANAGER FOR ORACLE DATABASE, ORACLE JDEVELOPER, ORACLE FINANCIAL SERVICES PROFITABILITY MANAGEMENT, ORACLE RAPID PLANNING, ORACLE AGILE PLM MCAD CONNECTOR, ORACLE RETAIL RETURNS MANAGEMENT, ORACLE INSURANCE CALCULATION ENGINE, ORACLE RETAIL BACK OFFICE, ORACLE RETAIL SERVICE LAYER, ORACLE ENDECA INFORMATION DISCOVERY INTEGRATOR, ORACLE MANAGED FILE TRANSFER, ORACLE AGILE PLM, ORACLE API GATEWAY, ORACLE RETAIL INSIGHTS, ORACLE FINANCIAL SERVICES BEHAVIOR DETECTION PLATFORM, ORACLE JD EDWARDS PRODUCTS, ORACLE WEBLOGIC SERVER, ORACLE RETAIL WORKFORCE MANAGEMENT, PEOPLESOFT ENTERPRISE FIN SUPPLY CHAIN PORTAL PACK BRAZIL, ORACLE ENTERPRISE REPOSITORY, ORACLE INSURANCE POLICY ADMINISTRATION, ORACLE RETAIL XSTORE POINT OF SERVICE, ORACLE POLICY AUTOMATION, ORACLE COMMUNICATIONS CONVERGENT CHARGING CONTROLLER, ORACLE RETAIL ORDER BROKER, ORACLE INSURANCE RULES PALETTE, ORACLE ENDECA INFORMATION DISCOVERY STUDIO, ORACLE RETAIL EXTRACT TRANSFORM AND LOAD, JD EDWARDS ENTERPRISEONE TOOLS, BI PUBLISHER (FORMERLY XML PUBLISHER), ENTERPRISE MANAGER FOR FUSION MIDDLEWARE, ENTERPRISE MANAGER FOR PEOPLESOFT, ORACLE FLEXCUBE CORE BANKING, ORACLE RETAIL ASSORTMENT PLANNING, ORACLE RETAIL POINT-OF-SERVICE, ORACLE UTILITIES FRAMEWORK, ORACLE POLICY AUTOMATION FOR MOBILE DEVICES, ORACLE RETAIL FINANCIAL INTEGRATION, ORACLE FINANCIAL SERVICES APPLICATIONS, ORACLE ENDECA SERVER, ENTERPRISE MANAGER OPS CENTER, ORACLE RETAIL STORE INVENTORY MANAGEMENT, PEOPLESOFT ENTERPRISE FIN INSTALL, ORACLE UTILITIES ADVANCED SPATIAL AND OPERATIONAL ANALYTICS, ORACLE CONSTRUCTION AND ENGINEERING, ORACLE JD EDWARDS, ORACLE RETAIL CUSTOMER MANAGEMENT AND SEGMENTATION FOUNDATION, ORACLE FLEXCUBE PRIVATE BANKING, ORACLE FLEXCUBE INVESTOR SERVICING, ORACLE SECURE GLOBAL DESKTOP (SGD), ORACLE FINANCIAL SERVICES LOAN LOSS FORECASTING AND PROVISIONING, ORACLE CONFIGURATION MANAGER, MICROS RELATE CRM SOFTWARE, MYSQL ENTERPRISE MONITOR, ORACLE SIEBEL CRM, ORACLE RETAIL INTEGRATION BUS, ORACLE COMMUNICATIONS NETWORK INTELLIGENCE, ORACLE SUN SYSTEMS PRODUCTS SUITE, IDENTITY MANAGER CONNECTOR, ORACLE RETAIL OPEN COMMERCE PLATFORM, ORACLE COMMUNICATIONS APPLICATIONS, ORACLE UTILITIES APPLICATIONS, ORACLE ENTERPRISE MANAGER PRODUCTS SUITE, ORACLE RETAIL ORDER MANAGEMENT SYSTEM, ORACLE BANKING PLATFORM, ORACLE COMMUNICATIONS WEBRTC SESSION CONTROLLER, ORACLE AGILE ENGINEERING DATA MANAGEMENT, ORACLE RETAIL PREDICTIVE APPLICATION SERVER, ORACLE WEBCENTER PORTAL, ORACLE RETAIL CONVENIENCE AND FUEL POS SOFTWARE, ORACLE RETAIL PRICE MANAGEMENT, ORACLE RETAIL APPLICATIONS, ORACLE APPLICATION TESTING SUITE, ORACLE IN-MEMORY PERFORMANCE-DRIVEN PLANNING, ORACLE SOA SUITE, ORACLE FINANCIAL SERVICES FUNDS TRANSFER PRICING, ORACLE SUPPLY CHAIN, ENTERPRISE MANAGER BASE PLATFORM, ORACLE FINANCIAL SERVICES HEDGE MANAGEMENT AND IFRS VALUATIONS, ORACLE COMMUNICATIONS MESSAGING SERVER, MICROS RETAIL XBRI LOSS PREVENTION, ORACLE RETAIL FISCAL MANAGEMENT, ORACLE POLICY AUTOMATION CONNECTOR FOR SIEBEL, ORACLE FINANCIAL SERVICES REGULATORY REPORTING WITH AGILEREPORTER, PRIMAVERA GATEWAY, ORACLE BUSINESS INTELLIGENCE DATA WAREHOUSE ADMINISTRATION CONSOLE, ORACLE COMMUNICATIONS NETWORK INTEGRITY, ORACLE RETAIL CENTRAL OFFICE, ORACLE COMMUNICATIONS SERVICES GATEKEEPER, INSTANTIS ENTERPRISETRACK, ORACLE UTILITIES NETWORK MANAGEMENT SYSTEM, ORACLE AUTOVUE VUELINK INTEGRATION, ORACLE RETAIL SERVICE BACKBONE, ORACLE COMMUNICATIONS UNIFIED INVENTORY MANAGEMENT, ORACLE PEOPLESOFT PRODUCTS, ORACLE COMMUNICATIONS PRICING DESIGN CENTER, ORACLE UTILITIES WORK AND ASSET MANAGEMENT, ORACLE GOLDENGATE APPLICATION ADAPTERS, ORACLE RETAIL INVOICE MATCHING, ORACLE ENTERPRISE DATA QUALITY, ORACLE COMMUNICATIONS SERVICE BROKER, ORACLE IDENTITY MANAGEMENT SUITE, ORACLE TRANSPORTATION MANAGEMENT, PEOPLESOFT ENTERPRISE FIN SUPPLY CHAIN PORTAL PACK ARGENTINA
References
Timeline
Timeline
| Published | 2017-04-17 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-10-08 | NVD's own last-modified date for this record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |
| Last VRT activity | 2026-11-13 | Most recent commit touching this CVE's classification, patch or rule file. |