Moderate: Red Hat Security Advisory: Red Hat Process Automation Manager 7.12.1 security update

An update is now available for Red Hat Process Automation Manager. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

logback: remote code execution through JNDI call from within its configuration file

A flaw was found in the logback package. When using a specially-crafted configuration, this issue could allow a remote authenticated attacker to execute arbitrary code loaded from LDAP servers...

BSA-2022-1675

Security Advisory ID : BSA-2022-1675 Component : logback Revision : 1.0 In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers. Brocade has...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Logback

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Logback. Vulnerability Details CVEID: CVE-2021-42550 DESCRIPTION: Logback could allow a remote authenticated attacker to execute arbitrary code on the system. By using a specially-crafted configuration, an...

logback deserialization RCE

The vulnerability of the logback logging library is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

com.twitter:finatra-http_2.12 (18.2.0), com.twitter:finatra-thrift_2.12 (18.2.0) +6 more potentially affected by CVE-2020-35774 via com.twitter:twitter-server_2.12 (18.2.0)

com.twitter:twitter-server2.12 MAVEN version 18.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.twitter:twitter-server2.12 and may be impacted: - com.twitter:finatra-http2.12 18.2.0 - com.twitter:finatra-thrift2.12 18.2.0 -...

openSUSE: Security Advisory for logback (openSUSE-SU-2021:4109-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE: Security Advisory for logback (openSUSE-SU-2021:1613-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Mageia: Security Advisory (MGASA-2019-0079)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OESA-2021-1476 logback security update

Logback is intended as a successor to the popular log4j project. Security Fixes: In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP...

OPENSUSE-SU-2021:1613-1 Security update for logback

This update for logback fixes the following issues: Upgrade to version 1.2.8 + In response to log4Shell/CVE-2021-44228, all JNDI lookup code in logback has been disabled until further notice. This impacts ContextJNDISelector and insertFromJNDI element in configuration files. + Also in response to...

Security update for logback (important)

openSUSE Security Update: Security update for logback Announcement ID: openSUSE-SU-2021:1613-1 Rating: important References: 1193795 Cross-References: CVE-2021-44228 CVSS scores: CVE-2021-44228 NVD : 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2021-44228 SUSE: 9.8...

Remote Code Execution (RCE)

logback is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of write access allowing an attacker to craft a malicious configuration...

Quality Open Software logback remote code execution vulnerability

Quality Open Software logback is a logging framework for Java applications from Quality Open Software of Switzerland. quality Open Software logback in versions 1.2.7 and earlier is vulnerable to remote code execution, which stems from a failure to effectively filter user input. The vulnerability...

ch.qos.logback:logback-access (0.9.20), ch.qos.logback:logback-classic (0.9.20) +25 more potentially affected by CVE-2021-42550 via ch.qos.logback:logback-core (0.9.20)

ch.qos.logback:logback-core MAVEN version 0.9.20 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-core and may be impacted: - ch.qos.logback:logback-access 0.9.20 - ch.qos.logback:logback-classic 0.9.20 -...

ch.qos.logback:log4j-bridge (0.9.6), ch.qos.logback:logback-access (0.9.6) +4 more potentially affected by CVE-2021-42550 via ch.qos.logback:logback-core (0.9.6)

ch.qos.logback:logback-core MAVEN version 0.9.6 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-core and may be impacted: - ch.qos.logback:log4j-bridge 0.9.6 - ch.qos.logback:logback-access 0.9.6 - ch.qos.logback:logback-classic...

ch.qos.logback:logback-access (0.9.22), ch.qos.logback:logback-classic (0.9.22) +1 more potentially affected by CVE-2021-42550 via ch.qos.logback:logback-core (0.9.22)

ch.qos.logback:logback-core MAVEN version 0.9.22 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-core and may be impacted: - ch.qos.logback:logback-access 0.9.22 - ch.qos.logback:logback-classic 0.9.22 -...

ch.qos.logback:logback-access (0.9.23), ch.qos.logback:logback-classic (0.9.23) +1 more potentially affected by CVE-2021-42550 via ch.qos.logback:logback-core (0.9.23)

ch.qos.logback:logback-core MAVEN version 0.9.23 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-core and may be impacted: - ch.qos.logback:logback-access 0.9.23 - ch.qos.logback:logback-classic 0.9.23 -...

ch.qos.logback:logback-access (0.9.17), ch.qos.logback:logback-classic (0.9.17) +21 more potentially affected by CVE-2021-42550 via ch.qos.logback:logback-core (0.9.17)

ch.qos.logback:logback-core MAVEN version 0.9.17 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-core and may be impacted: - ch.qos.logback:logback-access 0.9.17 - ch.qos.logback:logback-classic 0.9.17 -...

ch.qos.logback:logback-access (0.9.11), ch.qos.logback:logback-classic (0.9.11) +2 more potentially affected by CVE-2021-42550 via ch.qos.logback:logback-core (0.9.11)

ch.qos.logback:logback-core MAVEN version 0.9.11 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-core and may be impacted: - ch.qos.logback:logback-access 0.9.11 - ch.qos.logback:logback-classic 0.9.11 -...