GHSA-668q-qrv7-99fm

Deserialization of Untrusted Data in logback

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-42550

Packages

Ecosystem	Package	Affected	Fixed in
Maven	ch.qos.logback:logback-core	< 1.2.9	1.2.9

Details

As written in the advisory (Markdown source, shown as plain text).

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-42550 advisory
https://github.com/qos-ch/logback/commit/87291079a1de9369ac67e20dc70a8fdc7cc4359c web
https://github.com/qos-ch/logback/commit/ef4fc4186b74b45ce80d86833820106ff27edd42 web
https://cert-portal.siemens.com/productcert/pdf/ssa-371761.pdf web
https://github.com/cn-panda/logbackRceDemo web
https://github.com/qos-ch/logback package
https://github.com/qos-ch/logback/blob/1502cba4c1dfd135b2e715bc0cf80c0045d4d128/logback-site/src/site/pages/news.html web
https://jira.qos.ch/browse/LOGBACK-1591 web
https://security.netapp.com/advisory/ntap-20211229-0001 web
http://logback.qos.ch/news.html web
http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html web
http://seclists.org/fulldisclosure/2022/Jul/11 web