Описание
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| logback | fixed | 1:1.1.9-3 | package | |
| logback | fixed | 1:1.1.2-1+deb8u1 | jessie | package |
Примечания
https://github.com/qos-ch/logback/commit/f46044b805bca91efe5fd6afe52257cd02f775f8
https://github.com/qos-ch/logback/commit/979b042cb1f0b4c1e5869ccc8912e68c39f769f9
https://github.com/qos-ch/logback/commit/7fbea6127fa98fc48368ca5e8540eefe0e60cec5
https://github.com/qos-ch/logback/commit/3b4f605454534b304770eeee3cb343521fcd6968
Information asked about complete patchset to fix CVE-2017-5929: http://mailman.qos.ch/pipermail/logback-user/2017-March/004875.html
EPSS
Связанные уязвимости
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
QOS.ch Logback vulnerable to Deserialization of Untrusted Data
Уязвимость класса logback-core в файле QOS.ch библиотеки Jackson-databind, позволяющая нарушителю выполнить произвольный код
EPSS