Included in Log4j 1.2 is a SocketServer class that is vulnerable to
deserialization of untrusted data which can be exploited to remotely execute
arbitrary code when combined with a deserialization gadget when listening to
untrusted network traffic for log data. This affects Log4j versions up to
1.2 up to 1.2.17.
Note from Debian :
"CVE-2019-17571 correspond to CVE-2017-5645 for apache-log4j2. 1.2.x branch
is end-of-life upstream and does not recieve a fix for this issue. Users
should upgrade to Log4j 2.x."
Improper validation of certificate with host mismatch in Apache Log4j SMTP
appender. This could allow an SMTPS connection to be intercepted by a
man-in-the-middle attack which could leak any log messages sent through that