CVE-2017-5929
published 2017-03-13CVE-2017-5929: QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
PriorityP347critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
7.50%
93.8th percentile
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | logback | < logback 1:1.1.9-3 (bookworm) | logback 1:1.1.9-3 (bookworm) |
| qos | logback | < 1.2.0 | 1.2.0 |
| qos | logback | >= 0 < 1:1.1.9-3 | 1:1.1.9-3 |
| qos | logback | >= 0 < 1:1.1.9-3 | 1:1.1.9-3 |
| qos | logback | >= 0 < 1:1.1.9-3 | 1:1.1.9-3 |
| qos | logback | >= 0 < 1:1.1.9-3 | 1:1.1.9-3 |
| redhat | satellite | — | — |
| redhat | satellite_capsule | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
logback: Serialization vulnerability in SocketServer and ServerSocketReceiver
vendor_redhat·2017-02-08·CVSS 9.8
CVE-2017-5929 [CRITICAL] CWE-502 logback: Serialization vulnerability in SocketServer and ServerSocketReceiver
logback: Serialization vulnerability in SocketServer and ServerSocketReceiver
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
It was found that logback is vulnerable to a deserialization issue. Logback can be configured to allow remote logging through SocketServer/ServerSocketReceiver interfaces that can accept untrusted serialized data. Authenticated attackers on the adjacent network can leverage this vulnerability to execute arbitrary code through deserialization of custom gadget chains.
Statement: The vulnerability applies to logback-classic and logback-core.There is no documented evidence in the official upstream advisory that logback-json-core is affected.
Package: logback-classic (Red Hat JBoss Fuse Int
Debian
CVE-2017-5929: logback - QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the Sock...
vendor_debian·2017·CVSS 9.8
CVE-2017-5929 [CRITICAL] CVE-2017-5929: logback - QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the Sock...
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
Scope: local
bookworm: resolved (fixed in 1:1.1.9-3)
bullseye: resolved (fixed in 1:1.1.9-3)
forky: resolved (fixed in 1:1.1.9-3)
sid: resolved (fixed in 1:1.1.9-3)
trixie: resolved (fixed in 1:1.1.9-3)
OSV
QOS.ch Logback vulnerable to Deserialization of Untrusted Data
osv·2021-06-07
CVE-2017-5929 [CRITICAL] QOS.ch Logback vulnerable to Deserialization of Untrusted Data
QOS.ch Logback vulnerable to Deserialization of Untrusted Data
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components. The RemoteStreamAppenderClient class in logback-classic and the SocketNode classes in logback-classic and logback-access allow data to be deserialized over a Java Socket, via an ObjectInputStream, without validating the data beforehand. When data is received from the Socket, to be logged, it is deserialized into Java objects.An attacker can exploit this vulnerability by sending malicious, serialized Java objects over the connection to the Socket, which may result in execution of arbitrary code when those objects are deserialized. Note that although logback-core is implicated by the Logback project here,
GHSA
QOS.ch Logback vulnerable to Deserialization of Untrusted Data
ghsa·2021-06-07
CVE-2017-5929 [CRITICAL] CWE-502 QOS.ch Logback vulnerable to Deserialization of Untrusted Data
QOS.ch Logback vulnerable to Deserialization of Untrusted Data
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components. The RemoteStreamAppenderClient class in logback-classic and the SocketNode classes in logback-classic and logback-access allow data to be deserialized over a Java Socket, via an ObjectInputStream, without validating the data beforehand. When data is received from the Socket, to be logged, it is deserialized into Java objects.An attacker can exploit this vulnerability by sending malicious, serialized Java objects over the connection to the Socket, which may result in execution of arbitrary code when those objects are deserialized. Note that although logback-core is implicated by the Logback project here,
OSV
CVE-2017-5929: QOS
osv·2017-03-13·CVSS 9.8
CVE-2017-5929 [CRITICAL] CVE-2017-5929: QOS
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
No detection rules found.
No public exploits indexed.
HackerOne
CVE-2017-5929: Hyperledger - Arbitrary Deserialization of Untrusted Data
hackerone·2022-10-18·CVSS 9.8
CVE-2017-5929 [CRITICAL] CVE-2017-5929: Hyperledger - Arbitrary Deserialization of Untrusted Data
CVE-2017-5929: Hyperledger - Arbitrary Deserialization of Untrusted Data
## Vulnerability Overview
Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.
Deserialization of untrusted data (CWE-502), is when the application deserializes untrust
HackerOne
2 vulnerabilities of arbitrary code in ████████ - CVE-2017-5929
hackerone·2019-10-08·CVSS 9.8
CVE-2017-5929 [CRITICAL] 2 vulnerabilities of arbitrary code in ████████ - CVE-2017-5929
2 vulnerabilities of arbitrary code in ████████ - CVE-2017-5929
**Summary:**
GitHub repo: https://github.com/████████
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
High Severity
Arbitrary Code Execution
Vulnerable module: ch.qos.logback:logback-core
Introduced through: com.github.dblock.waffle:[email protected]
Detailed paths
Introduced through: ███@█████████#a746bb4ecce1cb252a301c08be0daffa480c9747 › com.github.dblock.waffle:[email protected] › ch.qos.logback:[email protected]
Introduced through: ██████@███#a746bb4ecce1cb252a301c08be0daffa480c9747 › com.github.dblock.waffle:[email protected] › ch.qos.logback:[email protected] › ch.qos.logback:[email protected]
and
High Severity
Arbitrary Code
Bugzilla
CVE-2017-5929 logback: Serialization vulnerability in SocketServer and ServerSocketReceiver
bugzilla·2017-03-16·CVSS 9.8
CVE-2017-5929 [CRITICAL] CVE-2017-5929 logback: Serialization vulnerability in SocketServer and ServerSocketReceiver
CVE-2017-5929 logback: Serialization vulnerability in SocketServer and ServerSocketReceiver
It was found that logback is vulnerable to a deserialization issue. Logback can be configured to allow remote logging through SocketServer/ServerSocketReceiver interfaces that can accept untrusted serialized data. Authenticated attackers on the adjacent network can leverage this vulnerability to execute arbitrary code through deserialization of custom gadget chains.
References:
https://logback.qos.ch/news.html
Discussion:
Upstream commit:
https://github.com/qos-ch/logback/commit/f46044b805bca91efe5fd6afe52257cd02f775f8
---
This issue has been addressed in the following products:
Red Hat JBoss BRMS
Via RHSA-2017:1676 https://access.redhat.com/errata/RHSA-2017:1676
---
This issue has been
https://access.redhat.com/errata/RHSA-2017:1675https://access.redhat.com/errata/RHSA-2017:1676https://access.redhat.com/errata/RHSA-2017:1832https://access.redhat.com/errata/RHSA-2018:2927https://lists.apache.org/thread.html/18d509024d9aeb07f0e9579066f80bf5d4dcf20467b0c240043890d1%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/a6db61616180d73711d6db25703085940026e2dbc40f153f9d22b203%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/fa4eaaa6ff41ac6f79811e053c152ee89b7c5da8a6ac848ae97df67f%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r0bb19330e48d5ad784fa20dacba9e5538d8d60f5cd9142e0f1432b4b%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r2a08573ddee4a86dc96d469485a5843a01710ee0dc2078dfca410c79%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r2c2d57ca180e8173c90fe313ddf8eabbdcf8e3ae196f8b9f42599790%40%3Ccommits.mnemonic.apache.org%3Ehttps://lists.apache.org/thread.html/r397bf63783240fbb5713389d3f889d287ae0c11509006700ac720037%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r4673642893562c58cbee60c151ded6c077e8a2d02296e862224a9161%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r632ec30791b441e2eb5a3129532bf1b689bf181d0ef7daf50bcf0fd6%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r718f27bed898008a8e037d9cc848cfc1df4d18abcbaee0cb0c142cfb%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r967953a14e05016bc4bcae9ef3dd92e770181158b4246976ed8295c9%40%3Cdev.brooklyn.apache.org%3Ehttps://lists.apache.org/thread.html/ra007cec726a3927c918ec94c4316d05d1829c49eae8dc3648adc35e2%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/rbb4dfca2f7e3e8f3570eec21c79832d33a51dfde6762725660b60169%40%3Cdev.mnemonic.apache.org%3Ehttps://lists.apache.org/thread.html/rc5f0cc2f3b153bdf15ee7389d78585829abc9c7af4d322ba1085dd3e%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/rd2227af3c9ada2a72dc72ed05517f5857a34d487580e1f2803922ff9%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/re9b787727291786dfe088e3cd078c7d195c0b5781e15d3cd24a3b2fc%40%3Cdev.mnemonic.apache.org%3Ehttps://logback.qos.ch/news.htmlhttps://access.redhat.com/errata/RHSA-2017:1675https://access.redhat.com/errata/RHSA-2017:1676https://access.redhat.com/errata/RHSA-2017:1832https://access.redhat.com/errata/RHSA-2018:2927https://lists.apache.org/thread.html/18d509024d9aeb07f0e9579066f80bf5d4dcf20467b0c240043890d1%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/a6db61616180d73711d6db25703085940026e2dbc40f153f9d22b203%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/fa4eaaa6ff41ac6f79811e053c152ee89b7c5da8a6ac848ae97df67f%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r0bb19330e48d5ad784fa20dacba9e5538d8d60f5cd9142e0f1432b4b%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r2a08573ddee4a86dc96d469485a5843a01710ee0dc2078dfca410c79%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r2c2d57ca180e8173c90fe313ddf8eabbdcf8e3ae196f8b9f42599790%40%3Ccommits.mnemonic.apache.org%3Ehttps://lists.apache.org/thread.html/r397bf63783240fbb5713389d3f889d287ae0c11509006700ac720037%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r4673642893562c58cbee60c151ded6c077e8a2d02296e862224a9161%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r632ec30791b441e2eb5a3129532bf1b689bf181d0ef7daf50bcf0fd6%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r718f27bed898008a8e037d9cc848cfc1df4d18abcbaee0cb0c142cfb%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r967953a14e05016bc4bcae9ef3dd92e770181158b4246976ed8295c9%40%3Cdev.brooklyn.apache.org%3Ehttps://lists.apache.org/thread.html/ra007cec726a3927c918ec94c4316d05d1829c49eae8dc3648adc35e2%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/rbb4dfca2f7e3e8f3570eec21c79832d33a51dfde6762725660b60169%40%3Cdev.mnemonic.apache.org%3Ehttps://lists.apache.org/thread.html/rc5f0cc2f3b153bdf15ee7389d78585829abc9c7af4d322ba1085dd3e%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/rd2227af3c9ada2a72dc72ed05517f5857a34d487580e1f2803922ff9%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/re9b787727291786dfe088e3cd078c7d195c0b5781e15d3cd24a3b2fc%40%3Cdev.mnemonic.apache.org%3Ehttps://logback.qos.ch/news.html
2017-03-13
Published