GitHub Advisoryadvisory · Maven

GHSA-vmq6-5m68-f53m logback serialization vulnerability

HIGH Published 2023-11-29 Modified 2024-11-29 Official page ↗
Aliases
CVE-2023-6378
Ecosystem
Maven
Packages
ch.qos.logback:logback-classic, ch.qos.logback:logback-core
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Weaknesses
CWE-502
Reviewed
2023-11-29

Affected packages

• Maven ch.qos.logback:logback-classic: >= 1.3.0, < 1.3.12 → fixed in 1.3.12 • Maven ch.qos.logback:logback-classic: >= 1.4.0, < 1.4.12 → fixed in 1.4.12 • Maven ch.qos.logback:logback-core: >= 1.3.0, < 1.3.12 → fixed in 1.3.12 • Maven ch.qos.logback:logback-core: >= 1.4.0, < 1.4.12 → fixed in 1.4.12 • Maven ch.qos.logback:logback-core: < 1.2.13 → fixed in 1.2.13 • Maven ch.qos.logback:logback-classic: < 1.2.13 → fixed in 1.2.13

Description

A serialization vulnerability in logback receiver component part of logback allows an attacker to mount a Denial-Of-Service attack by sending poisoned data. This is only exploitable if logback receiver component is deployed. See https://logback.qos.ch/manual/receivers.html

Related

Alias · CVE (1)

  • CVE-2023-6378 A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References