Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

logback-classic-1.1.3.jar: 4 vulnerabilities (highest severity is: 9.8) reachable #30

Open
mend-for-github-com bot opened this issue Apr 17, 2023 · 0 comments
Open

logback-classic-1.1.3.jar: 4 vulnerabilities (highest severity is: 9.8) reachable #30

mend-for-github-com bot opened this issue Apr 17, 2023 · 0 comments
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend

Comments

@mend-for-github-com
Copy link

mend-for-github-com bot commented Apr 17, 2023 •
edited
Loading

Vulnerable Library - logback-classic-1.1.3.jar

logback-classic module

Library home page: http://www.qos.ch

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/ch/qos/logback/logback-classic/1.1.3/logback-classic-1.1.3.jar

Found in HEAD commit: 643a7fad08d6608eaf25b22f87aee4b43387f2fc

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (logback-classic version) Remediation Possible** Reachability
CVE-2017-5929 Critical 9.8 detected in multiple dependencies Transitive 1.2.0 ✅

Reachable
CVE-2023-6481 High 7.1 logback-core-1.1.3.jar Transitive N/A* ❌

Reachable
CVE-2023-6378 High 7.1 logback-classic-1.1.3.jar Direct 1.2.13 ✅

Reachable
CVE-2021-42550 Medium 6.6 detected in multiple dependencies Transitive N/A* ✅

Reachable

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2017-5929

Vulnerable Libraries - logback-core-1.1.3.jar, logback-classic-1.1.3.jar

logback-core-1.1.3.jar

logback-core module

Library home page: http://www.qos.ch

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/ch/qos/logback/logback-core/1.1.3/logback-core-1.1.3.jar

Dependency Hierarchy:

  • logback-classic-1.1.3.jar (Root Library)
    • ❌ logback-core-1.1.3.jar (Vulnerable Library)

logback-classic-1.1.3.jar

logback-classic module

Library home page: http://www.qos.ch

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/ch/qos/logback/logback-classic/1.1.3/logback-classic-1.1.3.jar

Dependency Hierarchy:

  • ❌ logback-classic-1.1.3.jar (Vulnerable Library)

Found in HEAD commit: 643a7fad08d6608eaf25b22f87aee4b43387f2fc

Found in base branch: vp-rem

Reachability Analysis

This vulnerability is potentially reachable

com.visualpathit.account.service.SecurityServiceImpl (Application)
  -> org.slf4j.LoggerFactory (Extension)
   -> org.slf4j.impl.StaticLoggerBinder (Extension)
    -> ch.qos.logback.classic.BasicConfigurator (Extension)
    ...
      -> ch.qos.logback.classic.PatternLayout (Extension)
       -> ch.qos.logback.core.pattern.parser.Parser (Extension)
        -> ❌ ch.qos.logback.core.pattern.parser.Compiler (Vulnerable Component)

Vulnerability Details

QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.

Publish Date: 2017-03-13

URL: CVE-2017-5929

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5929

Release Date: 2017-03-13

Fix Resolution (ch.qos.logback:logback-core): 1.2.0

Direct dependency fix Resolution (ch.qos.logback:logback-classic): 1.2.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-6481

Vulnerable Library - logback-core-1.1.3.jar

logback-core module

Library home page: http://www.qos.ch

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/ch/qos/logback/logback-core/1.1.3/logback-core-1.1.3.jar

Dependency Hierarchy:

  • logback-classic-1.1.3.jar (Root Library)
    • ❌ logback-core-1.1.3.jar (Vulnerable Library)

Found in HEAD commit: 643a7fad08d6608eaf25b22f87aee4b43387f2fc

Found in base branch: vp-rem

Reachability Analysis

This vulnerability is potentially reachable

com.visualpathit.account.service.SecurityServiceImpl (Application)
  -> org.slf4j.LoggerFactory (Extension)
   -> org.slf4j.impl.StaticLoggerBinder (Extension)
    -> ch.qos.logback.classic.BasicConfigurator (Extension)
    ...
      -> ch.qos.logback.classic.PatternLayout (Extension)
       -> ch.qos.logback.core.pattern.parser.Parser (Extension)
        -> ❌ ch.qos.logback.core.pattern.parser.Compiler (Vulnerable Component)

Vulnerability Details

A serialization vulnerability in logback receiver component part of
logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service
attack by sending poisoned data.

Publish Date: 2023-12-04

URL: CVE-2023-6481

CVSS 3 Score Details (7.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-6481

Release Date: 2023-12-04

Fix Resolution: ch.qos.logback:logback-core:1.2.13,1.3.14,1.4.14

CVE-2023-6378

Vulnerable Library - logback-classic-1.1.3.jar

logback-classic module

Library home page: http://www.qos.ch

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/ch/qos/logback/logback-classic/1.1.3/logback-classic-1.1.3.jar

Dependency Hierarchy:

  • ❌ logback-classic-1.1.3.jar (Vulnerable Library)

Found in HEAD commit: 643a7fad08d6608eaf25b22f87aee4b43387f2fc

Found in base branch: vp-rem

Reachability Analysis

This vulnerability is potentially reachable

com.visualpathit.account.service.SecurityServiceImpl (Application)
  -> org.slf4j.LoggerFactory (Extension)
   -> org.slf4j.impl.StaticLoggerBinder (Extension)
    -> ch.qos.logback.classic.joran.JoranConfigurator (Extension)
    ...
      -> ch.qos.logback.classic.net.SocketAppender (Extension)
       -> ch.qos.logback.classic.net.LoggingEventPreSerializationTransformer (Extension)
        -> ❌ ch.qos.logback.classic.spi.LoggingEventVO (Vulnerable Component)

Vulnerability Details

A serialization vulnerability in logback receiver component part of
logback version 1.4.11 allows an attacker to mount a Denial-Of-Service
attack by sending poisoned data.

Publish Date: 2023-11-29

URL: CVE-2023-6378

CVSS 3 Score Details (7.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://logback.qos.ch/news.html#1.3.12

Release Date: 2023-11-29

Fix Resolution: 1.2.13

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-42550

Vulnerable Libraries - logback-core-1.1.3.jar, logback-classic-1.1.3.jar

logback-core-1.1.3.jar

logback-core module

Library home page: http://www.qos.ch

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/ch/qos/logback/logback-core/1.1.3/logback-core-1.1.3.jar

Dependency Hierarchy:

  • logback-classic-1.1.3.jar (Root Library)
    • ❌ logback-core-1.1.3.jar (Vulnerable Library)

logback-classic-1.1.3.jar

logback-classic module

Library home page: http://www.qos.ch

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/ch/qos/logback/logback-classic/1.1.3/logback-classic-1.1.3.jar

Dependency Hierarchy:

  • ❌ logback-classic-1.1.3.jar (Vulnerable Library)

Found in HEAD commit: 643a7fad08d6608eaf25b22f87aee4b43387f2fc

Found in base branch: vp-rem

Reachability Analysis

This vulnerability is potentially reachable

com.visualpathit.account.service.SecurityServiceImpl (Application)
  -> org.slf4j.LoggerFactory (Extension)
   -> org.slf4j.impl.StaticLoggerBinder (Extension)
    -> ch.qos.logback.classic.util.ContextSelectorStaticBinder (Extension)
     -> ❌ ch.qos.logback.core.util.OptionHelper (Vulnerable Component)

Vulnerability Details

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.
Mend Note: Converted from WS-2021-0491, on 2022-11-07.

Publish Date: 2021-12-16

URL: CVE-2021-42550

CVSS 3 Score Details (6.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2021-42550

Release Date: 2021-12-16

Fix Resolution: ch.qos.logback:logback-classic:1.2.9;ch.qos.logback:logback-core:1.2.9

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.
@mend-for-github-com mend-for-github-com bot added the Mend: dependency security vulnerability Security vulnerability detected by Mend label Apr 17, 2023
@mend-for-github-com mend-for-github-com bot mentioned this issue Apr 17, 2023
Open
1 task
@mend-for-github-com mend-for-github-com bot changed the title logback-classic-1.1.3.jar: 2 vulnerabilities (highest severity is: 9.8) logback-classic-1.1.3.jar: 2 vulnerabilities (highest severity is: 9.8) reachable Jul 2, 2023
@mend-for-github-com mend-for-github-com bot changed the title logback-classic-1.1.3.jar: 2 vulnerabilities (highest severity is: 9.8) reachable logback-classic-1.1.3.jar: 3 vulnerabilities (highest severity is: 9.8) reachable Dec 6, 2023
@mend-for-github-com mend-for-github-com bot changed the title logback-classic-1.1.3.jar: 3 vulnerabilities (highest severity is: 9.8) reachable logback-classic-1.1.3.jar: 4 vulnerabilities (highest severity is: 9.8) reachable Feb 28, 2024
@mend-for-github-com mend-for-github-com bot changed the title logback-classic-1.1.3.jar: 4 vulnerabilities (highest severity is: 9.8) reachable logback-classic-1.1.3.jar: 3 vulnerabilities (highest severity is: 7.5) reachable Apr 12, 2024
@mend-for-github-com mend-for-github-com bot changed the title logback-classic-1.1.3.jar: 3 vulnerabilities (highest severity is: 7.5) reachable logback-classic-1.1.3.jar: 4 vulnerabilities (highest severity is: 9.8) reachable Jul 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
0 participants