CVE-2021-42550Deserialization of Untrusted Data in Logback

Severity
6.6MEDIUMNVD
EPSS
2.7%
top 14.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedDec 16
Latest updateJul 2

Description

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.7 | Impact: 5.9

Affected Packages6 packages

CVEListV5qos.ch/logbackunspecified1.2.9+1
Debianqos/logback< 1:1.2.8-1+2
Ubuntuqos/logback< 1:1.1.3-2ubuntu0.1~esm1+3
NVDqos/logback1.2.7+1
NVDsiemens/sinec_nms< 1.0.3

Patches

🔴Vulnerability Details

5
OSV
logback vulnerabilities2025-07-02
GHSA
Deserialization of Untrusted Data in logback2021-12-17
OSV
Deserialization of Untrusted Data in logback2021-12-17
OSV
CVE-2021-42550: In logback version 12021-12-16
CVEList
RCE from attacker with configuration edit priviledges through JNDI lookup2021-12-16

📋Vendor Advisories

3
Ubuntu
logback vulnerabilities2025-07-02
Red Hat
logback: remote code execution through JNDI call from within its configuration file2021-12-16
Debian
CVE-2021-42550: logback - In logback version 1.2.7 and prior versions, an attacker with the required privi...2021

🕵️Threat Intelligence

2
Sentinelone
Log4j One Month On | Crimeware and Exploitation Roundup2022-01-10
Sentinelone
Log4j One Month On | Crimeware and Exploitation Roundup2022-01-10
CVE-2021-42550 — Deserialization of Untrusted Data | cvebase