Deserialization of Untrusted Data

Overview ch.qos.logback:logback-core is a logback-core module. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in HardenedObjectInputStream, whose resolveClass allowlist admitted any class whose name starts with java.lang or java.util rather than matching...