Описание
A serialization vulnerability in logback receiver component part of
logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service
attack by sending poisoned data.
A flaw was found in the logback package. Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') via the logback receiver component. This flaw allows an attacker to mount a denial-of-service attack by sending poisoned data.
Отчет
The security vulnerability in the logback package is considered of moderate severity due to its potential for facilitating a denial-of-service (DoS) attack. While a DoS attack can disrupt service availability, this vulnerability may not lead to more severe consequences such as unauthorized access or data breaches.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| A-MQ Clients 2 | logback | Not affected | ||
| Logging Subsystem for Red Hat OpenShift | openshift-logging/elasticsearch6-rhel8 | Not affected | ||
| Migration Toolkit for Applications 6 | logback | Not affected | ||
| Migration Toolkit for Applications 7 | logback | Not affected | ||
| Migration Toolkit for Runtimes | logback | Not affected | ||
| Red Hat build of Apache Camel for Spring Boot 3 | logback | Out of support scope | ||
| Red Hat build of Debezium 2 | logback | Will not fix | ||
| Red Hat Build of Keycloak | logback | Not affected | ||
| Red Hat build of OptaPlanner 8 | logback | Affected | ||
| Red Hat build of Quarkus | ch.qos.logback/logback-core | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.
A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.
A serialization vulnerability in logback receiver component part of l ...
Logback is vulnerable to an attacker mounting a Denial-Of-Service attack by sending poisoned data
EPSS
7.5 High
CVSS3