PT-2018-2981 · Qos.Ch+3 · Slf4J+3
Published
2018-03-20
·
Updated
2024-06-15
·
CVE-2018-8088
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
SLF4J versions prior to 1.7.26
SLF4J versions prior to 1.8.0-beta2
SLF4J versions 1.8.0-beta2 through 1.8.0-beta3
Description
The issue is related to the org.slf4j.ext.EventData component in the slf4j-ext module of the SLF4J library, which allows remote attackers to bypass intended access restrictions via crafted data. This is due to the restoration of an invalid data structure in memory. The estimated number of potentially affected devices is not specified.
Recommendations
For SLF4J versions prior to 1.7.26, update to version 1.7.26 or later.
For SLF4J versions prior to 1.8.0-beta2, update to version 1.8.0-beta2 or later, but note that versions up to 1.8.0-beta3 are still vulnerable.
For SLF4J versions 1.8.0-beta2 through 1.8.0-beta3, update to version 1.8.0-beta4 or later.
As a temporary workaround, consider restricting access to the
org.slf4j.ext.EventData component until a patch is available.Fix
Deserialization of Untrusted Data
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Centos
Red Hat
Slf4J
Suse