CVE-2017-5929: Critical severity logback-core vulnerability
It was found that logback is vulnerable to a deserialization issue. Logback can be configured to allow remote logging through SocketServer/ServerSocketReceiver interfaces that can accept untrusted serialized data. Authenticated attackers on the adjacent network can leverage this vulnerability to execute arbitrary code through deserialization of custom gadget chains.
References:
https://logback.qos.ch/news.html
Other sources
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5929?
CVE-2017-5929 is classified as a medium severity vulnerability due to the potential for remote code execution via deserialization.
How do I fix CVE-2017-5929?
To fix CVE-2017-5929, upgrade to Logback version 1.2.0 or later.
Which versions of Logback are affected by CVE-2017-5929?
CVE-2017-5929 affects all versions of Logback prior to 1.2.0.
What components are vulnerable in CVE-2017-5929?
CVE-2017-5929 affects the SocketServer and ServerSocketReceiver components of Logback.
Can CVE-2017-5929 lead to remote attack vectors?
Yes, CVE-2017-5929 allows for potential remote attacks through vulnerable remote logging configurations.