Описание
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
It was found that logback is vulnerable to a deserialization issue. Logback can be configured to allow remote logging through SocketServer/ServerSocketReceiver interfaces that can accept untrusted serialized data. Authenticated attackers on the adjacent network can leverage this vulnerability to execute arbitrary code through deserialization of custom gadget chains.
Отчет
The vulnerability applies to logback-classic and logback-core.There is no documented evidence in the official upstream advisory that logback-json-core is affected.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat JBoss Fuse Integration Service 2 | logback-classic | Affected | ||
| Red Hat Subscription Asset Manager | logback-core | Will not fix | ||
| Red Hat Fuse 7.6.0 | logback-core | Fixed | RHSA-2020:0983 | 26.03.2020 |
| Red Hat JBoss A-MQ 6.3 | camel | Fixed | RHSA-2017:1832 | 10.08.2017 |
| Red Hat JBoss BPMS 6.4 | logback-core | Fixed | RHSA-2017:1675 | 04.07.2017 |
| Red Hat JBoss BRMS 6.4 | logback-core | Fixed | RHSA-2017:1676 | 04.07.2017 |
| Red Hat JBoss Fuse 6.3 | camel | Fixed | RHSA-2017:1832 | 10.08.2017 |
| Red Hat Satellite 6.4 for RHEL 7 | ansiblerole-insights-client | Fixed | RHSA-2018:2927 | 16.10.2018 |
| Red Hat Satellite 6.4 for RHEL 7 | candlepin | Fixed | RHSA-2018:2927 | 16.10.2018 |
| Red Hat Satellite 6.4 for RHEL 7 | createrepo_c | Fixed | RHSA-2018:2927 | 16.10.2018 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
QOS.ch Logback before 1.2.0 has a serialization vulnerability affectin ...
QOS.ch Logback vulnerable to Deserialization of Untrusted Data
Уязвимость класса logback-core в файле QOS.ch библиотеки Jackson-databind, позволяющая нарушителю выполнить произвольный код
EPSS
5.5 Medium
CVSS3