Описание
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
It was found that logback is vulnerable to a deserialization issue. Logback can be configured to allow remote logging through SocketServer/ServerSocketReceiver interfaces that can accept untrusted serialized data. Authenticated attackers on the adjacent network can leverage this vulnerability to execute arbitrary code through deserialization of custom gadget chains.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat JBoss Fuse 6 | camel | Affected | ||
| Red Hat JBoss Fuse Integration Service 2 | logback-classic | Affected | ||
| Red Hat Subscription Asset Manager | logback-core | Will not fix | ||
| Red Hat Fuse 7.6.0 | logback-core | Fixed | RHSA-2020:0983 | 26.03.2020 |
| Red Hat JBoss A-MQ 6.3 | Fixed | RHSA-2017:1832 | 10.08.2017 | |
| Red Hat JBoss BPMS 6.4 | logback-core | Fixed | RHSA-2017:1675 | 04.07.2017 |
| Red Hat JBoss BRMS 6.4 | logback-core | Fixed | RHSA-2017:1676 | 04.07.2017 |
| Red Hat JBoss Fuse 6.3 | Fixed | RHSA-2017:1832 | 10.08.2017 | |
| Red Hat Satellite 6.4 for RHEL 7 | ansiblerole-insights-client | Fixed | RHSA-2018:2927 | 16.10.2018 |
| Red Hat Satellite 6.4 for RHEL 7 | candlepin | Fixed | RHSA-2018:2927 | 16.10.2018 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
QOS.ch Logback before 1.2.0 has a serialization vulnerability affectin ...
QOS.ch Logback vulnerable to Deserialization of Untrusted Data
Уязвимость класса logback-core в файле QOS.ch библиотеки Jackson-databind, позволяющая нарушителю выполнить произвольный код
EPSS
5.5 Medium
CVSS3