Description
In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| QOS.ch | logback | unspecified – < 1.2.9, unspecified – < 1.3.0-alpha11 | 1.2.9 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | logback | 1:1.2.8-1 | — |
| Debian 13 | logback | 1:1.2.8-1 | — |
| Debian 12 | logback | 1:1.2.8-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | logback | 1:1.2.10-1ubuntu0.1~esm1 | USN-7616-1 |
| Ubuntu Pro 20.04 LTS | logback | 1:1.2.3-5ubuntu0.1~esm1 | USN-7616-1 |
| Ubuntu Pro 18.04 LTS | logback | 1:1.2.3-2ubuntu1~18.04.1+esm1 | USN-7616-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | logback | 1:1.1.3-2ubuntu0.1~esm1 | USN-7616-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman | 3.1.1.21-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite Utils 6 | satellite | 6.11.0-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | foreman | 3.1.1.21-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | libsolv | 0.7.22-1.el7pc | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | python-django +1 | 3.2.13-1.el8pc | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | python-lxml | 4.7.1-1.el8pc | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | python-sqlparse | 0.4.2-2.el8pc | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | satellite | 6.11.0-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | candlepin | 4.1.13-1.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | foreman | 3.1.1.21-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | libsolv | 0.7.22-1.el7pc | RHSA-2022:5498 |
| Red Hat Satellite 6 | python-django +1 | 3.2.13-1.el8pc | RHSA-2022:5498 |
| Red Hat Satellite 6 | python-lxml | 4.7.1-1.el8pc | RHSA-2022:5498 |
| Red Hat Satellite 6 | python-sqlparse | 0.4.2-2.el8pc | RHSA-2022:5498 |
| Red Hat Satellite 6 | rubygem-actionpack | 6.0.4.7-1.el8sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | rubygem-puma | 5.6.2-1.el8sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | rubygem-sidekiq | 5.2.10-1.el8sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | satellite | 6.11.0-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | tfm-rubygem-actionpack | 6.0.4.7-1.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | tfm-rubygem-puma | 5.6.2-1.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | tfm-rubygem-sidekiq | 5.2.10-1.el7sat | RHSA-2022:5498 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | libdb | 5.3.28-42.el8_4 | RLSA-2022:5498 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | maven | 3.8.6-150200.4.9.8 | SUSE-SU-2023:2097-1 |
| SLES 15 SP4 | minlog | 1.3.1-150200.3.7.8 | SUSE-SU-2023:2097-1 |
| SLES 15 SP4 | xmvn +1 | 4.0.0-150200.3.7.1 | SUSE-SU-2023:2097-1 |
| SLES 15 SP4 | xmvn-connector | 4.0.0-150200.3.7.3 | SUSE-SU-2023:2097-1 |
| SLES 15 SP4 | xmvn-mojo | 4.0.0-150200.3.7.8 | SUSE-SU-2023:2097-1 |
| SLES 15 SP3 | maven | 3.8.6-150200.4.9.8 | SUSE-SU-2023:2097-1 |
| SLES 15 SP3 | minlog | 1.3.1-150200.3.7.8 | SUSE-SU-2023:2097-1 |
| SLES 15 SP3 | xmvn +1 | 4.0.0-150200.3.7.1 | SUSE-SU-2023:2097-1 |
| SLES 15 SP3 | xmvn-connector | 4.0.0-150200.3.7.3 | SUSE-SU-2023:2097-1 |
| SLES 15 SP3 | xmvn-mojo | 4.0.0-150200.3.7.8 | SUSE-SU-2023:2097-1 |
| SLES 15 SP2 | maven | 3.8.6-150200.4.9.8 | SUSE-SU-2023:2097-1 |
| SLES 15 SP2 | minlog | 1.3.1-150200.3.7.8 | SUSE-SU-2023:2097-1 |
| SLES 15 SP2 | xmvn +1 | 4.0.0-150200.3.7.1 | SUSE-SU-2023:2097-1 |
| SLES 15 SP2 | xmvn-connector | 4.0.0-150200.3.7.3 | SUSE-SU-2023:2097-1 |
| SLES 15 SP2 | xmvn-mojo | 4.0.0-150200.3.7.8 | SUSE-SU-2023:2097-1 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP3 | maven | 3.8.6-150200.4.9.8 | SUSE-SU-2023:2097-1 |
| SLES for SAP 15 SP3 | minlog | 1.3.1-150200.3.7.8 | SUSE-SU-2023:2097-1 |
| SLES for SAP 15 SP3 | xmvn +1 | 4.0.0-150200.3.7.1 | SUSE-SU-2023:2097-1 |
| SLES for SAP 15 SP3 | xmvn-connector | 4.0.0-150200.3.7.3 | SUSE-SU-2023:2097-1 |
| SLES for SAP 15 SP3 | xmvn-mojo | 4.0.0-150200.3.7.8 | SUSE-SU-2023:2097-1 |
| SLES for SAP 15 SP2 | maven | 3.8.6-150200.4.9.8 | SUSE-SU-2023:2097-1 |
| SLES for SAP 15 SP2 | minlog | 1.3.1-150200.3.7.8 | SUSE-SU-2023:2097-1 |
| SLES for SAP 15 SP2 | xmvn +1 | 4.0.0-150200.3.7.1 | SUSE-SU-2023:2097-1 |
| SLES for SAP 15 SP2 | xmvn-connector | 4.0.0-150200.3.7.3 | SUSE-SU-2023:2097-1 |
| SLES for SAP 15 SP2 | xmvn-mojo | 4.0.0-150200.3.7.8 | SUSE-SU-2023:2097-1 |
| SLE Real Time 15 SP3 | maven | 3.8.6-150200.4.9.8 | SUSE-SU-2023:2097-1 |
| SLE Real Time 15 SP3 | minlog | 1.3.1-150200.3.7.8 | SUSE-SU-2023:2097-1 |
| SLE Real Time 15 SP3 | xmvn +1 | 4.0.0-150200.3.7.1 | SUSE-SU-2023:2097-1 |
| SLE Real Time 15 SP3 | xmvn-connector | 4.0.0-150200.3.7.3 | SUSE-SU-2023:2097-1 |
| SLE Real Time 15 SP3 | xmvn-mojo | 4.0.0-150200.3.7.8 | SUSE-SU-2023:2097-1 |
| SLE HPC 15 SP3 | maven | 3.8.6-150200.4.9.8 | SUSE-SU-2023:2097-1 |
| SLE HPC 15 SP3 | minlog | 1.3.1-150200.3.7.8 | SUSE-SU-2023:2097-1 |
| SLE HPC 15 SP3 | xmvn +1 | 4.0.0-150200.3.7.1 | SUSE-SU-2023:2097-1 |
| SLE HPC 15 SP3 | xmvn-connector | 4.0.0-150200.3.7.3 | SUSE-SU-2023:2097-1 |
| SLE HPC 15 SP3 | xmvn-mojo | 4.0.0-150200.3.7.8 | SUSE-SU-2023:2097-1 |
| SLE HPC 15 SP2 | maven | 3.8.6-150200.4.9.8 | SUSE-SU-2023:2097-1 |
| SLE HPC 15 SP2 | minlog | 1.3.1-150200.3.7.8 | SUSE-SU-2023:2097-1 |
| SLE HPC 15 SP2 | xmvn +1 | 4.0.0-150200.3.7.1 | SUSE-SU-2023:2097-1 |
| SLE HPC 15 SP2 | xmvn-connector | 4.0.0-150200.3.7.3 | SUSE-SU-2023:2097-1 |
| SLE HPC 15 SP2 | xmvn-mojo | 4.0.0-150200.3.7.8 | SUSE-SU-2023:2097-1 |
| SUSE Manager Server Module 4.3 | antlr3-java | 3.5.3-150200.3.11.8 | SUSE-SU-2023:2097-1 |
| SUSE Enterprise Storage 7.1 | maven | 3.8.6-150200.4.9.8 | SUSE-SU-2023:2097-1 |
| SUSE Enterprise Storage 7.1 | minlog | 1.3.1-150200.3.7.8 | SUSE-SU-2023:2097-1 |
| SUSE Enterprise Storage 7.1 | xmvn +1 | 4.0.0-150200.3.7.1 | SUSE-SU-2023:2097-1 |
| SUSE Enterprise Storage 7.1 | xmvn-connector | 4.0.0-150200.3.7.3 | SUSE-SU-2023:2097-1 |
| SUSE Enterprise Storage 7.1 | xmvn-mojo | 4.0.0-150200.3.7.8 | SUSE-SU-2023:2097-1 |
| SUSE Enterprise Storage 7 | maven | 3.8.6-150200.4.9.8 | SUSE-SU-2023:2097-1 |
| SUSE Enterprise Storage 7 | minlog | 1.3.1-150200.3.7.8 | SUSE-SU-2023:2097-1 |
| SUSE Enterprise Storage 7 | xmvn +1 | 4.0.0-150200.3.7.1 | SUSE-SU-2023:2097-1 |
| SUSE Enterprise Storage 7 | xmvn-connector | 4.0.0-150200.3.7.3 | SUSE-SU-2023:2097-1 |
| SUSE Enterprise Storage 7 | xmvn-mojo | 4.0.0-150200.3.7.8 | SUSE-SU-2023:2097-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.4 | antlr3 +2 | 3.5.3-150200.3.11.8 | SUSE-SU-2023:2097-1 |
| openSUSE Leap 15.4 | maven | 3.8.6-150200.4.9.8 | SUSE-SU-2023:2097-1 |
| openSUSE Leap 15.4 | minlog | 1.3.1-150200.3.7.8 | SUSE-SU-2023:2097-1 |
| openSUSE Leap 15.4 | sbt +1 | 0.13.18-150200.4.7.8 | SUSE-SU-2023:2097-1 |
| openSUSE Leap 15.4 | xmvn +2 | 4.0.0-150200.3.7.1 | SUSE-SU-2023:2097-1 |
| openSUSE Leap 15.4 | xmvn-connector | 4.0.0-150200.3.7.3 | SUSE-SU-2023:2097-1 |
| openSUSE Leap 15.4 | xmvn-mojo | 4.0.0-150200.3.7.8 | SUSE-SU-2023:2097-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | ch.qos.logback:logback-core | < 1.2.9 | 1.2.9 | GHSA-668q-qrv7-99fm |
Advisories 13
- RHSA-2022:5498 Red Hat Security Advisory: Satellite 6.11 Release Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2022-0607 Red Hat FUSE: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 9, 2026
- USN-7616-1 logback vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- RLSA-2022:5498 Moderate: Satellite 6.11 Release Rocky Linux Security Advisories · Feb 5, 2026
- SUSE-SU-2023:2097-1 Security update for maven and recommended update for antlr3, minlog, sbt, xmvn SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2022-1375 JFrog Artifactory: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- WID-SEC-2023-0063 Juniper Junos Space: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 8, 2025
- WID-SEC-2022-0572 Logback: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Jul 2, 2025
- WID-SEC-2024-0519 IBM Maximo Asset Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 29, 2024
- WID-SEC-2022-1461 IBM Spectrum Protect: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 20, 2023
- ICSA-22-314-03 Siemens SINEC Network Management System Logback Component CISA ICS & IT advisories · Nov 8, 2022
- SSA-371761 SSA-371761: Arbitrary Code Execution Vulnerability in the Logback Component of SINEC NMS before V1.0.3 Siemens ProductCERT · Nov 8, 2022
References
- http://logback.qos.ch/news.html
- https://github.com/cn-panda/logbackRceDemo
- https://jira.qos.ch/browse/LOGBACK-1591
- https://security.netapp.com/advisory/ntap-20211229-0001/
- 20220721 Open-Xchange Security Advisory 2022-07-21 mailing-list
- http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-371761.pdf