CVE-2023-6378
HIGH7.1EPSS 0.63%logback serialization vulnerability
發布日:2023/11/29修改日:2026/4/28
描述
A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.
受影響套件(3)
- Debian/logbackfrom 0
- Maven/ch.qos.logback:logback-classic>= 1.3.0, < 1.3.12
- Maven/ch.qos.logback:logback-core>= 1.3.0, < 1.3.12
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
參考連結(11)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-6378
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2023-6378
- PATCHhttps://github.com/qos-ch/logback
- WEBhttps://github.com/qos-ch/logback/commit/9c782b45be4abdafb7e17481e24e7354c2acd1eb
- WEBhttps://github.com/qos-ch/logback/commit/b8eac23a9de9e05fb6d51160b3f46acd91af9731
- WEBhttps://github.com/qos-ch/logback/commit/bb095154be011267b64e37a1d401546e7cc2b7c3
- WEBhttps://github.com/qos-ch/logback/issues/745#issuecomment-1836227158
- WEBhttps://logback.qos.ch/manual/receivers.html
- WEBhttps://logback.qos.ch/news.html#1.2.13
- WEBhttps://logback.qos.ch/news.html#1.3.12
- WEBhttps://security.netapp.com/advisory/ntap-20241129-0012