Skip to content
OpenAdvisories
High ALAS2-2018-999 1 CVE

Important: slf4j security update (Amazon Linux 2)

Published Apr 19, 2018 · Updated Apr 19, 2018

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-8088: An XML deserialization vulnerability was discovered in slf4j's EventData which accepts anXML serialized string and can lead to arbitrary code execution. 1548909: CVE-2018-8088 slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2 slf4j 0:1.7.4-4.amzn2
Amazon Linux · 2 slf4j-javadoc 0:1.7.4-4.amzn2
Amazon Linux · 2 slf4j-manual 0:1.7.4-4.amzn2

Vulnerabilities 1

  • Critical 9.8
    CVE-2018-8088 EPSS 15%

    Improper Access Control in SLF4J

    org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 late…

    org.slf4j:slf4j-ext libslf4j-java Debian Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-8088.html