CVE-2017-5929: Critical severity qos logback vulnerability
It was found that logback is vulnerable to a deserialization issue. Logback can be configured to allow remote logging through SocketServer/ServerSocketReceiver interfaces that can accept untrusted serialized data. Authenticated attackers on the adjacent network can leverage this vulnerability to execute arbitrary code through deserialization of custom gadget chains.
References:
https://logback.qos.ch/news.html
Other sources
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/logback-classicto a version that resolves this vulnerability.Fixed in 1.2.0 - Upgrade
Upgrade
logbackto a version that resolves this vulnerability.Fixed in 1.2.0 - Configuration
Reconfigure Logback so that the SocketServer/ServerSocketReceiver interfaces are not used to accept remote/untrusted serialized data (disable remote logging via these interfaces if not needed).
logback SocketServer/ServerSocketReceiver remote logging via SocketServer/ServerSocketReceiver interfaces that accept untrusted serialized data = disabled (do not accept untrusted serialized data)
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5929?
CVE-2017-5929 is classified as a medium severity vulnerability due to the potential for remote code execution via deserialization.
How do I fix CVE-2017-5929?
To fix CVE-2017-5929, upgrade to Logback version 1.2.0 or later.
Which versions of Logback are affected by CVE-2017-5929?
CVE-2017-5929 affects all versions of Logback prior to 1.2.0.
What components are vulnerable in CVE-2017-5929?
CVE-2017-5929 affects the SocketServer and ServerSocketReceiver components of Logback.
Can CVE-2017-5929 lead to remote attack vectors?
Yes, CVE-2017-5929 allows for potential remote attacks through vulnerable remote logging configurations.