CVE-2018-8088 Improper Access Control in SLF4J
CriticalCVSS 9.8
EPSS 14.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.slf4j/slf4j-ext(Maven) | <= 1.7.25 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | >= 1.8.0-alpha0, <= 1.8.0-beta2 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | < 1.7.26 | 1.7.26 |
| org.slf4j/slf4j-ext(Maven) | = 1.0-alpha0 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.5.10 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.5.11 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.5.4 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.5.5 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.5.6 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.5.7 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.5.8 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.5.9-RC0 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.5.9.RC1 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.6.0 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.6.0-RC0 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.6.0-alpha2 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.6.1 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.6.2 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.6.3 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.6.4 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.6.5 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.6.6 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.7.0 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.7.1 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.7.10 | No fix listed |
Show 65 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.slf4j/slf4j-ext(Maven) | = 1.7.11 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.7.12 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.7.13 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.7.14 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.7.15 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.7.16 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.7.18 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.7.19 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.7.2 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.7.20 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.7.21 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.7.22 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.7.23 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.7.24 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.7.25 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.7.3 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.7.4 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.7.5 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.7.6 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.7.7 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.7.8 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.7.9 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | >= 1.8.0-alpha0, < 1.8.0-beta4 | 1.8.0-beta4 |
| org.slf4j/slf4j-ext(Maven) | = 1.8.0-alpha0 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.8.0-alpha1 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.8.0-alpha2 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.8.0-beta0 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.8.0-beta1 | No fix listed |
| org.slf4j/slf4j-ext(Maven) | = 1.8.0-beta2 | No fix listed |
| debian/libslf4j-java(Debian:12) | < 1.7.25-3 | 1.7.25-3 |
| debian/libslf4j-java(Debian:13) | < 1.7.25-3 | 1.7.25-3 |
| debian/libslf4j-java(Debian:14) | < 1.7.25-3 | 1.7.25-3 |
| qos slf4j | < 1.7.26 | 1.7.26 |
| qos slf4j | = 1.8.0-alpha1 | No fix listed |
| qos slf4j | = 1.8.0-alpha2 | No fix listed |
| qos slf4j | = 1.8.0-beta1 | No fix listed |
| qos slf4j | = 1.8.0-beta2 | No fix listed |
| redhat jboss enterprise application platform | = 7.1 | No fix listed |
| redhat jboss enterprise application platform | = 6.0.0 | No fix listed |
| redhat jboss enterprise application platform | = 6.4.0 | No fix listed |
| redhat virtualization | = 4.0 | No fix listed |
| redhat virtualization host | = 4.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux eus | = 7.4 | No fix listed |
| redhat enterprise linux eus | = 7.5 | No fix listed |
| redhat enterprise linux eus | = 7.6 | No fix listed |
| redhat enterprise linux eus | = 7.7 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server aus | = 7.7 | No fix listed |
| redhat enterprise linux server tus | = 7.4 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.7 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| oracle goldengate application adapters | = 12.3.2.1.0 | No fix listed |
| oracle GoldenGate Stream Analytics | < 19.1.0.0.1 | 19.1.0.0.1 |
| oracle utilities framework | = 4.2.0.2.0 | No fix listed |
| oracle utilities framework | = 4.2.0.3.0 | No fix listed |
| oracle utilities framework | = 4.3.0.2.0 | No fix listed |
| oracle utilities framework | = 4.3.0.3.0 | No fix listed |
| oracle utilities framework | = 4.3.0.4.0 | No fix listed |
| oracle utilities framework | = 4.3.0.5.0 | No fix listed |
| oracle utilities framework | = 4.3.0.6.0 | No fix listed |
| oracle utilities framework | = 4.4.0.0.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- RHSA-2018:0582 third-party-advisory vendor-advisory
- RHSA-2018:0592 third-party-advisory vendor-advisory
- RHSA-2018:0627 third-party-advisory vendor-advisory
- RHSA-2018:0628 third-party-advisory vendor-advisory
- RHSA-2018:0629 third-party-advisory vendor-advisory
- RHSA-2018:0630 third-party-advisory vendor-advisory
- RHSA-2018:1247 third-party-advisory vendor-advisory
- RHSA-2018:1248 third-party-advisory vendor-advisory
- RHSA-2018:1249 third-party-advisory vendor-advisory
- RHSA-2018:1251 third-party-advisory vendor-advisory
- RHSA-2018:1323 third-party-advisory vendor-advisory
- RHSA-2018:1447 third-party-advisory vendor-advisory
- RHSA-2018:1448 third-party-advisory vendor-advisory
- RHSA-2018:1449 third-party-advisory vendor-advisory
- RHSA-2018:1450 third-party-advisory vendor-advisory
- RHSA-2018:1451 third-party-advisory vendor-advisory
- RHSA-2018:1525 third-party-advisory vendor-advisory
- RHSA-2018:1575 third-party-advisory vendor-advisory
- RHSA-2018:2143 third-party-advisory vendor-advisory
- RHSA-2018:2419 third-party-advisory vendor-advisory
- RHSA-2018:2420 third-party-advisory vendor-advisory
- RHSA-2018:2669 third-party-advisory vendor-advisory
- RHSA-2018:2930 third-party-advisory vendor-advisory
- RHSA-2019:2413 third-party-advisory vendor-advisory
- RHSA-2019:3140 third-party-advisory vendor-advisory
- jira.qos.ch issue-tracking vendor-advisory
- jira.qos.ch issue-tracking vendor-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com
- www.oracle.com patch third-party-advisory
- [infra-devnull] 20190321 [GitHub] [tika] dadoonet opened pull request #268: Update slf4j to 1.8.0-beta4 mailing-list
- [infra-devnull] 20190321 [GitHub] [tika] grossws commented on issue #268: Update slf4j to 1.8.0-beta4 mailing-list
- [zookeeper-issues] 20210327 [jira] [Created] (ZOOKEEPER-4264) Apache Zookeeper 3.6.2 - slf4j 1.7.25 has security vulnerability CVE-2018-8088 mailing-list
- [hadoop-common-issues] 20200824 [jira] [Updated] (HADOOP-17220) Upgrade slf4j to 1.7.30 ( To Address: CVE-2018-8088) mailing-list
- [iotdb-notifications] 20210325 [jira] [Created] (IOTDB-1258) jcl-over-slf4j have Security Vulnerabilities CVE-2018-8088 mailing-list
- [iotdb-reviews] 20210327 [GitHub] [iotdb] wangchao316 closed pull request #2906: [IOTDB-1258] jcl-over-slf4j have security vulnerabilities CVE-2018-8088 mailing-list
- [zookeeper-issues] 20210327 [jira] [Updated] (ZOOKEEPER-4264) Apache Zookeeper 3.6.2 - slf4j 1.7.25 has security vulnerability CVE-2018-8088 mailing-list
- [iotdb-reviews] 20210325 [GitHub] [iotdb] wangchao316 opened a new pull request #2906: [IOTDB-1258] jcl-over-slf4j have security vulnerabilities CVE-2018-8088 mailing-list
- [iotdb-reviews] 20210327 [GitHub] [iotdb] wangchao316 opened a new pull request #2906: [IOTDB-1258] jcl-over-slf4j have security vulnerabilities CVE-2018-8088 mailing-list
- [flink-issues] 20210720 [jira] [Created] (FLINK-23444) Slf4j 1.7.15 has the high-risk vulnerability CVE-2018-8088 mailing-list
- [flink-issues] 20210804 [jira] [Closed] (FLINK-23444) Slf4j 1.7.15 has the high-risk vulnerability CVE-2018-8088 mailing-list
- [hadoop-common-issues] 20200824 [jira] [Updated] (HADOOP-17220) Upgrade slf4j to 1.7.30 ( To Adress: CVE-2018-8088) mailing-list
- [logging-notifications] 20200825 [jira] [Commented] (LOG4J2-2329) Fix dependency in log4j-slf4j-impl to slf4j due to CVE-2018-8088 mailing-list
- [flink-issues] 20210721 [jira] [Commented] (FLINK-23444) Slf4j 1.7.15 has the high-risk vulnerability CVE-2018-8088 mailing-list
- [pulsar-commits] 20210127 [GitHub] [pulsar] GLouMcK opened a new issue #9347: Security Vulnerabilities - Black Duck Scan mailing-list
- [flink-dev] 20210720 [jira] [Created] (FLINK-23444) Slf4j 1.7.15 has the high-risk vulnerability CVE-2018-8088 mailing-list
- [iotdb-commits] 20210328 [iotdb] branch master updated: [IOTDB-1258] jcl-over-slf4j have security vulnerabilities CVE-2018-8088 (#2906) mailing-list
- [hadoop-common-issues] 20200824 [jira] [Created] (HADOOP-17220) Upgrade slf4j to 1.7.30 ( To Adress: CVE-2018-8088) mailing-list
- [zookeeper-issues] 20210328 [jira] [Commented] (ZOOKEEPER-4264) Apache Zookeeper 3.6.2 - slf4j 1.7.25 has security vulnerability CVE-2018-8088 mailing-list
- [flink-issues] 20210725 [jira] [Commented] (FLINK-23444) Slf4j 1.7.15 has the high-risk vulnerability CVE-2018-8088 mailing-list
- [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list mailing-list
- [hadoop-common-commits] 20200824 [hadoop] branch branch-3.3 updated: HADOOP-17220. Upgrade slf4j to 1.7.30 ( To Address: CVE-2018-8088). Contributed by Brahma Reddy Battula. mailing-list
- [hadoop-common-commits] 20200824 [hadoop] branch trunk updated: HADOOP-17220. Upgrade slf4j to 1.7.30 ( To Address: CVE-2018-8088). Contributed by Brahma Reddy Battula. mailing-list
- [hadoop-common-dev] 20200824 [jira] [Created] (HADOOP-17220) Upgrade slf4j to 1.7.30 ( To Adress: CVE-2018-8088) mailing-list
- [zookeeper-dev] 20210327 [jira] [Created] (ZOOKEEPER-4264) Apache Zookeeper 3.6.2 - slf4j 1.7.25 has security vulnerability CVE-2018-8088 mailing-list
- [iotdb-reviews] 20210328 [GitHub] [iotdb] HTHou merged pull request #2906: [IOTDB-1258] jcl-over-slf4j have security vulnerabilities CVE-2018-8088 mailing-list
- [hadoop-common-issues] 20200824 [jira] [Commented] (HADOOP-17220) Upgrade slf4j to 1.7.30 ( To Adress: CVE-2018-8088) mailing-list
- security.netapp.com
- www.slf4j.org
- 103737 third-party-advisory vdb-entry
- 1040627 third-party-advisory vdb-entry
- github.com
- Debian Security Tracker CVE-2018-8088 vendor-advisory
- bugs.debian.org issue-tracking