GitHub Advisoryadvisory · Maven

GHSA-668q-qrv7-99fm Deserialization of Untrusted Data in logback

MEDIUM Published 2021-12-17 Modified 2021-12-17 Official page ↗
Aliases
CVE-2021-42550
Ecosystem
Maven
Packages
ch.qos.logback:logback-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2021-12-17

Affected packages

• Maven ch.qos.logback:logback-core: < 1.2.9 → fixed in 1.2.9

Description

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.

Related

Alias · CVE (1)

  • CVE-2021-42550 In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References