Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Update logback to v1.2.x - CVE-2017-5929

See original GitHub issue

Logback < 1.2.0 contains a rather serious serialization vulnerability. See https://logback.qos.ch/news.html as well.

Currently Logback v1.1.11 is included in spring-boot-starter-logging v1.5.2.RELEASE.

As far as I can tell Spring Boots default logback configuration is not affected however users might be adding their own configuration file and therefore might be affected.

For example adding the following in a custom logback configuration file would make the application potentially vulnerable.

  <receiver class="ch.qos.logback.classic.net.server.ServerSocketReceiver">
    <port>${port}</port>
  </receiver>

Issue Analytics

State:
Created 7 years ago
Reactions:1
Comments:9 (5 by maintainers)

Top GitHub Comments

1reaction

wilkinsonacommented, Apr 1, 2017

Thanks @izeye

0reactions

izeyecommented, Mar 31, 2017

@wilkinsona Target milestone (2.0.0.M1) is missing.

Top Results From Across the Web

News - Logback - QOS.ch

Logback components written for logback 1.2 should work without change in version 1.3. However, Joran, logback's configuration system, has been rewritten to ...

protect against potential for logback exploit CVE-2017-5929

When data is received from the Socket, to be logged, it is deserialized into Java objects. An attacker can exploit this vulnerability by...

CVE-2017-5929 Detail - NVD

QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.

CVE-2017-5929

Description Tags Link Logback News Vendor Advisory logback.qos.ch text/html CONFIRM logback.qos... Red Hat Customer Portal access.redhat.com text/html REDHAT RHSA‑2018:2... Red Hat Customer Portal access.redhat.com text/html REDHAT...

#857343 - logback: CVE-2017-5929: serialization vulnerability ...

Subject: liblogback-java: logback < 1.2.0 has a vulnerability in ... 2.7.0-2 [ObjectInputStream-mitigation.patch (text/x-diff, attachment)] ...