CVE-2017-5929 QOS.ch Logback vulnerable to Deserialization of Untrusted Data
CriticalCVSS 9.8
EPSS 7.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ch.qos.logback/logback-classic(Maven) | < 1.2.0 | 1.2.0 |
| ch.qos.logback/logback-core(Maven) | < 1.2.0 | 1.2.0 |
| debian/logback(Debian:12) | < 1:1.1.9-3 | 1:1.1.9-3 |
| debian/logback(Debian:14) | < 1:1.1.9-3 | 1:1.1.9-3 |
| debian/logback(Debian:13) | < 1:1.1.9-3 | 1:1.1.9-3 |
| ch.qos.logback/logback-classic(Maven) | = 0.2.5 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.3 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.5 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.6 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.7 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.7.1 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.8 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.8.1 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.1 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.10 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.11 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.12 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.13 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.14 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.15 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.16 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.17 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.18 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.19 | No fix listed |
Show 113 more
| Product | Affected versions | Fixed in |
|---|---|---|
| ch.qos.logback/logback-classic(Maven) | = 0.9.2 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.20 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.21 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.22 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.23 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.24 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.25 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.26 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.27 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.28 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.29 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.3 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.30 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.4 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.5 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.6 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.7 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.8 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 0.9.9 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.0.0 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.0.1 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.0.10 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.0.11 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.0.12 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.0.13 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.0.2 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.0.3 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.0.4 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.0.5 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.0.6 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.0.7 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.0.8 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.0.9 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.1.0 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.1.1 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.1.10 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.1.11 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.1.2 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.1.3 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.1.4 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.1.5 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.1.6 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.1.7 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.1.8 | No fix listed |
| ch.qos.logback/logback-classic(Maven) | = 1.1.9 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.2.5 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.3 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.5 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.6 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.7 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.7.1 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.8 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.8.1 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.1 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.10 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.11 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.12 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.13 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.14 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.15 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.16 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.17 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.18 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.19 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.2 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.20 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.21 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.22 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.23 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.24 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.25 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.26 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.27 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.28 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.29 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.3 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.30 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.4 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.5 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.6 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.7 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.8 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 0.9.9 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.0.0 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.0.1 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.0.10 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.0.11 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.0.12 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.0.13 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.0.2 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.0.3 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.0.4 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.0.5 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.0.6 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.0.7 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.0.8 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.0.9 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.1.0 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.1.1 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.1.10 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.1.11 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.1.2 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.1.3 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.1.4 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.1.5 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.1.6 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.1.7 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.1.8 | No fix listed |
| ch.qos.logback/logback-core(Maven) | = 1.1.9 | No fix listed |
| qos logback | < 1.2.0 | 1.2.0 |
| redhat satellite | = 6.4 | No fix listed |
| redhat satellite capsule | = 6.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- RHSA-2017:1675 third-party-advisory vendor-advisory
- RHSA-2017:1676 third-party-advisory vendor-advisory
- RHSA-2017:1832 third-party-advisory vendor-advisory
- RHSA-2018:2927 third-party-advisory vendor-advisory
- cve.mitre.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- logback.qos.ch release-notes vendor-advisory
- lists.apache.org
- github.com
- Debian Security Tracker CVE-2017-5929 vendor-advisory
- bugs.debian.org issue-tracking
- github.com product
- [cassandra-commits] 20191112 [jira] [Updated] (CASSANDRA-15411) [9.8] [CVE-2017-5929] [Cassandra] [2.2.5] mailing-list
- [cassandra-commits] 20191112 [jira] [Created] (CASSANDRA-15411) [9.8] [CVE-2017-5929] [Cassandra] [2.2.5] mailing-list
- [cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15421) CVE-2017-5929(QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.) mailing-list
- [cassandra-commits] 20210108 [jira] [Updated] (CASSANDRA-15421) CVE-2017-5929 in 3.11.x (QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.) mailing-list
- [cassandra-commits] 20210111 [jira] [Assigned] (CASSANDRA-15829) Upgrade to logback 1.2.3 to address CVE-2017-5929 mailing-list
- [mnemonic-commits] 20201204 [mnemonic] branch master updated: MNEMONIC-553: Fix for CVE-2017-5929 mailing-list
- [cassandra-commits] 20210111 [jira] [Commented] (CASSANDRA-15829) Upgrade to logback 1.2.3 to address CVE-2017-5929 mailing-list
- [cassandra-commits] 20210108 [jira] [Commented] (CASSANDRA-15829) Upgrade to logback 1.2.3 to address CVE-2017-5929 mailing-list
- [cassandra-commits] 20210923 [jira] [Updated] (CASSANDRA-15829) Upgrade to logback 1.2.3 to address CVE-2017-5929 mailing-list
- [cassandra-commits] 20210111 [jira] [Updated] (CASSANDRA-15421) CVE-2017-5929 in 3.11.x (QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.) mailing-list
- [brooklyn-dev] 20200420 [GitHub] [brooklyn-server] duncangrant opened a new pull request #1091: Update library versions due to CVEs mailing-list
- [cassandra-commits] 20210111 [jira] [Updated] (CASSANDRA-15829) Upgrade to logback 1.2.3 to address CVE-2017-5929 mailing-list
- [mnemonic-dev] 20201202 [GitHub] [mnemonic] yzz127 opened a new pull request #152: MNEMONIC-553: Fix for CVE-2017-5929 mailing-list
- [cassandra-commits] 20210111 [jira] [Updated] (CASSANDRA-15411) [9.8] [CVE-2017-5929] [Cassandra] [2.2.5] mailing-list
- [cassandra-commits] 20210108 [jira] [Updated] (CASSANDRA-15829) Upgrade to logback 1.2.3 to address CVE-2017-5929 mailing-list
- [mnemonic-dev] 20201204 [GitHub] [mnemonic] bigdata-memory merged pull request #152: MNEMONIC-553: Fix for CVE-2017-5929 mailing-list