Summary
It was discovered that Logback incorrectly handled deserialization of
untrusted data in its socket server and receiver components. A remote
attacker could possibly use this issue to execute arbitrary code.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | logback | 1:1.1.3-2ubuntu0.1~esm1 |
Vulnerabilities 1
-
Critical 9.8
QOS.ch Logback vulnerable to Deserialization of Untrusted Data
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
References
-
report
https://ubuntu.com/security/CVE-2017-5929