CVE-2023-6481: Logback "receiver" DOS vulnerability CVE-2023-6378 incomplete fix
Published Dec 4, 2023
·Updated
A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.
Affected Software
9 affected componentsFixes available
maven/ch.qos.logback:logback-core=1.2.12
1.2.13
maven/ch.qos.logback:logback-core=1.3.13
1.3.14
maven/ch.qos.logback:logback-core=1.4.13
1.4.14
qos logback=1.2.12
qos logback=1.3.13
qos logback=1.4.13
redhat/logback-classic<1.2.13
1.2.13
redhat/logback-classic<1.3.14
1.3.14
redhat/logback-classic<1.4.14
1.4.14
Remediation
Information
Only environments where logback receiver component is deployed may be vulnerable.
In case a logback receiver is deployed, restricting connections to
trustworthy clients or upgrading to logback version 1.4.14, 1.3.14, 1.2.13 or later will remedy the vulnerability.
If you do not need to deploy logback-receiver, then please verify that you do not have any <receiver></receiver> entries in your configuration files.
Event History
Dec 4, 2023
CVE Published
08:35 AM
Data Sourced
08:35 AM
RemedyDescriptionSeverityWeakness
Advisory Published
09:30 AM
Dec 5, 2023
Data Sourced
via Red Hat·12:42 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is CVE-2023-6481?
CVE-2023-6481 is a vulnerability in the logback receiver component of logback versions 1.4.13, 1.3.13, and 1.2.12.
2
What is the severity of CVE-2023-6481?
CVE-2023-6481 has a severity rating of 7.1 (high).
3
How does CVE-2023-6481 work?
CVE-2023-6481 is a serialization vulnerability that allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.
4
Which software versions are affected by CVE-2023-6481?
CVE-2023-6481 affects logback versions 1.4.13, 1.3.13, and 1.2.12.
5
How can I fix CVE-2023-6481?
To fix CVE-2023-6481, update logback to a version that includes the complete fix, such as version 1.4.14 or higher.