CVE-2023-26464: Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender
UNSUPPORTED WHEN ASSIGNED
When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested) hashmap or hashtable (depending on which logging component is in use) to be processed could exhaust the available memory in the virtual machine and achieve Denial of Service when the object is deserialized.
This issue affects Apache Log4j before 2. Affected users are recommended to update to Log4j 2.x.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Other sources
UNSUPPORTED WHEN ASSIGNED When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie deeply nested) hashmap or hashtable (depending on which logging component is in use) to be processed could exhaust the available memory in the virtual machine and achieve Denial of Service when the object is deserialized. This issue affects Apache Log4j before 2. Affected users are recommended to update to Log4j 2.x. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
— GitHub
Deserialization of a specially-crafted logging entry involving hashmap or hashtable could cause Denial of Service by exhausting the available memory in the virtual machine. This issue appears to affect only Java 1.6 or older versions.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.logging.log4j:log4j-coreto a version that resolves this vulnerability.Fixed in 2.0 - Upgrade
Upgrade
Apache Log4j 1.xto a version that resolves this vulnerability.Fixed in 2.x - Compensating control
If Chainsaw or SocketAppender components using Log4j 1.x are in use, avoid running them with JRE less than 1.7 (Java 1.6 or older) to prevent attacker-triggered deserialization of specially-crafted deeply nested hashmap/hashtable entries that can exhaust VM memory (DoS).
Event History
Frequently Asked Questions
What is CVE-2023-26464?
CVE-2023-26464 is a vulnerability that affects the Chainsaw or SocketAppender components in Log4j 1.x, allowing an attacker to cause a logging entry involving a specially-crafted hashmap or hashtable to be executed.
What software is affected by CVE-2023-26464?
The Log4j 1.x version up to and including 1.0.4, and Log4j 2.0.0 are affected by CVE-2023-26464.
How severe is CVE-2023-26464?
CVE-2023-26464 has a severity rating of 7.5 (High).
How can I fix CVE-2023-26464?
To fix CVE-2023-26464, upgrade to Log4j version 2.0.0 or above.
Where can I find more information about CVE-2023-26464?
You can find more information about CVE-2023-26464 on the NIST National Vulnerability Database (NVD) and Apache mailing lists.