Vulnerability CVE-2018-8088
Published: 2018-03-20

Description:
org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data.

Type:

CWE-502

 (Deserialization of Untrusted Data)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Slf4j -> Slf4j 
Slf4j -> Slf4j-ext 
Redhat -> Jboss enterprise application platform 
Redhat -> Enterprise linux desktop 
Redhat -> Enterprise linux server 
Redhat -> Enterprise linux workstation 
Oracle -> Utilities framework 

 References:
http://www.securityfocus.com/bid/103737
http://www.securitytracker.com/id/1040627
https://access.redhat.com/errata/RHSA-2018:0582
https://access.redhat.com/errata/RHSA-2018:0592
https://access.redhat.com/errata/RHSA-2018:0627
https://access.redhat.com/errata/RHSA-2018:0628
https://access.redhat.com/errata/RHSA-2018:0629
https://access.redhat.com/errata/RHSA-2018:0630
https://access.redhat.com/errata/RHSA-2018:1247
https://access.redhat.com/errata/RHSA-2018:1248
https://access.redhat.com/errata/RHSA-2018:1249
https://access.redhat.com/errata/RHSA-2018:1251
https://access.redhat.com/errata/RHSA-2018:1323
https://access.redhat.com/errata/RHSA-2018:1447
https://access.redhat.com/errata/RHSA-2018:1448
https://access.redhat.com/errata/RHSA-2018:1449
https://access.redhat.com/errata/RHSA-2018:1450
https://access.redhat.com/errata/RHSA-2018:1451
https://access.redhat.com/errata/RHSA-2018:1525
https://access.redhat.com/errata/RHSA-2018:1575
https://access.redhat.com/errata/RHSA-2018:2143
https://access.redhat.com/errata/RHSA-2018:2419
https://access.redhat.com/errata/RHSA-2018:2420
https://access.redhat.com/errata/RHSA-2018:2669
https://access.redhat.com/errata/RHSA-2018:2930
https://access.redhat.com/errata/RHSA-2019:2413
https://github.com/qos-ch/slf4j/commit/d2b27fba88e983f921558da27fc29b5f5d269405
https://jira.qos.ch/browse/SLF4J-430
https://jira.qos.ch/browse/SLF4J-431
https://lists.apache.org/thread.html/956ba8e76b6793a6670b2eb0129a5e3003ce2124ca3130fd57d48d0f@%3Cdevnull.infra.apache.org%3E
https://lists.apache.org/thread.html/95ce76613c869dbccf1d3d29327099ccc71aeec156f76c30853044fa@%3Cdevnull.infra.apache.org%3E
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
Copyright 2024, cxsecurity.com

 

Back to Top