CVE-2021-42550

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers...

CVE-2021-42550

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers...

UBUNTU-CVE-2021-42550

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers...

CVE-2021-42550

This CVE affects Logback 1.2.7 and earlier, where an attacker with write access to configuration files can craft a malicious configuration that loads and executes arbitrary code from LDAP servers. The impact is remote code execution with the attacker’s privileges on systems using vulnerable Logba...

Quality Open Software Logback Code Issues and Vulnerabilities

Quality Open Software logback is a logging framework for Java applications from Quality Open Software of Switzerland. quality Open Software logback in versions 1.2.7 and earlier is vulnerable to remote code execution, which stems from a failure to effectively filter user input. The vulnerability...

CVE-2021-42550 RCE from attacker with configuration edit priviledges through JNDI lookup

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers...

CVE-2021-42550: Deserialization of Untrusted Data

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers...

PT-2021-6084

Name of the Vulnerable Software and Affected Versions logback versions 1.2.7 and prior Description The issue is related to the deserialization mechanism in the logback library, which can be exploited by an attacker with the required privileges to edit configuration files. This could allow the...

CVE-2021-42550

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers...

CVE-2021-42550

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers...

Unsafe Deserialization in jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.8 an 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource...

GHSA-VFQX-33QM-G869 Unsafe Deserialization in jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.8 an 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource...

Unsafe Deserialization in jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource...

CVE-2019-12384

A flaw was discovered in FasterXML jackson-databind in versions prior to 2.9.9. The vulnerability would permit polymorphic deserialization of malicious objects using the logback-core gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when...

CVE-2019-14379

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the ehcache and logback JNDI gadgets when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLAS...

ch.qos.logback:logback-examples (0.9.23) potentially affected by CVE-2017-5929 via ch.qos.logback:logback-classic (0.9.23)

ch.qos.logback:logback-classic MAVEN version 0.9.23 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-classic and may be impacted: - ch.qos.logback:logback-examples 0.9.23 Source cves: CVE-2017-5929 Source advisory:...

ch.qos.logback:log4j-bridge (0.8), ch.qos.logback:logback-examples (0.8) potentially affected by CVE-2017-5929 via ch.qos.logback:logback-classic (0.8)

ch.qos.logback:logback-classic MAVEN version 0.8 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-classic and may be impacted: - ch.qos.logback:log4j-bridge 0.8 - ch.qos.logback:logback-examples 0.8 Source cves: CVE-2017-5929 Sour...

ch.qos.logback:logback-access (0.9.14), ch.qos.logback:logback-classic (0.9.14) +13 more potentially affected by CVE-2017-5929 via ch.qos.logback:logback-core (0.9.14)

ch.qos.logback:logback-core MAVEN version 0.9.14 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-core and may be impacted: - ch.qos.logback:logback-access 0.9.14 - ch.qos.logback:logback-classic 0.9.14 -...

ch.qos.logback:logback-examples (0.9.27), com.googlecode.jace:jace-core-java (>=1.2.4, <=1.2.7) +32 more potentially affected by CVE-2017-5929 via ch.qos.logback:logback-classic (0.9.27)

ch.qos.logback:logback-classic MAVEN version 0.9.27 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-classic and may be impacted: - ch.qos.logback:logback-examples 0.9.27 - com.googlecode.jace:jace-core-java =1.2.4, =1.2.4, =1.1.2...

GHSA-VMFG-RJJM-RJRJ QOS.ch Logback vulnerable to Deserialization of Untrusted Data

QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components. The RemoteStreamAppenderClient class in logback-classic and the SocketNode classes in logback-classic and logback-access allow data to be deserialized over a Java Socket,...