CVE-2018-8088

CWE-284 — Improper Access ControlCWE-502 — Deserialization of Untrusted Data13 documents8 sources
Severity
9.8CRITICAL
EPSS
1.9%
top 16.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
13
Oracle Goldengate Stream AnalyticsQOS Slf4jOracle Goldengate Application Adapters+10 more
Timeline
PublishedMar 20
Latest updateMay 13

Description

org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages12 packages

▶NVDqos/slf4j< 1.7.26+1
▶Mavenorg.slf4j:slf4j-ext1.8.0-alpha0 — 1.8.0-beta4+1
▶Debianlibslf4j-java< 1.7.25-3+3

Also affects: Enterprise Linux 7.4, 7.5, 7.6, 7.7

Patches

Patch: github.com ↗Patch: www.oracle.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
GHSA
Improper Access Control in SLF4J↗2022-05-13
▶
OSV
Improper Access Control in SLF4J↗2022-05-13
▶
CVEList
CVE-2018-8088: org↗2018-03-20
▶
OSV
CVE-2018-8088: org↗2018-03-20
▶

📋Vendor Advisories

5
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Web Services (slf4j-ext) — CVE-2018-8088↗2021-10-15
▶
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Application Adapters (SLF4J) — CVE-2018-8088↗2020-10-15
▶
Red Hat
jackson-databind: arbitrary code execution in slf4j-ext class↗2018-07-27
▶
Red Hat
slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution↗2018-02-22
▶
Debian
CVE-2018-8088: libslf4j-java - org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-bet...↗2018
▶

💬Community

3
Bugzilla
CVE-2018-8088 slf4j-jboss-logmanager: slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution [fedora-all]↗2018-02-28
▶
Bugzilla
CVE-2018-8088 slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution [fedora-all]↗2018-02-28
▶
Bugzilla
CVE-2018-8088 slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution↗2018-02-26
▶
CVE-2018-8088 (CRITICAL CVSS 9.8) | org.slf4j.ext.EventData in the slf4 | cvebase.io