PT-2017-3933 · Qos.Ch · Logback

Published 2017-03-13 · Updated 2026-05-15 · CVE-2017-5929

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QOS.ch Logback versions prior to 1.2.0

Description The issue is related to a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components. This vulnerability allows an attacker to exploit the deserialization of untrusted data, potentially leading to the execution of arbitrary code. The RemoteStreamAppenderClient class in logback-classic and the SocketNode classes in logback-classic and logback-access enable data deserialization over a Java Socket via an ObjectInputStream without prior validation. An attacker can send malicious, serialized Java objects over the connection, which may result in arbitrary code execution when deserialized.

Recommendations For QOS.ch Logback versions prior to 1.2.0, update to version 1.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the SocketServer and ServerSocketReceiver components to minimize the risk of exploitation. Additionally, avoid using the ObjectInputStream to deserialize data from untrusted sources until the issue is resolved.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2020-01666

CVE-2017-5929

DLA-888-1

GHSA-VMFG-RJJM-RJRJ

MGASA-2019-0079

RHSA-2018:2927

SUSE-SU-2021:2554-1

Affected Products

Logback

References · 103

• https://bdu.fstec.ru/vul/2020-01666 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-5929 · Security Note
• https://access.redhat.com/errata/RHSA-2017:1675 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:1676 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:2554-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-5929 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2927 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5929 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2017-5929 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0079 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0079.html · Security Note
• https://logback.qos.ch/news.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:1832 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-5929 · Security Note
• https://osv.dev/vulnerability/CVE-2017-5929 · Vendor Advisory