[CASSANDRA-19184] logback-core-1.2.12.jar vulnerability: CVE-2023-6481 - ASF JIRA

XML

Word

Printable

JSON

Details

Type: Bug
Status: Resolved
Priority: Normal
Resolution: Fixed
Fix Version/s: 5.0-rc1, 5.0, 5.1
Component/s: Dependencies
Labels:
None

Bug Category:
Security - Denial of Service
Severity:
Normal
Complexity:
Normal
Discovered By:
User Report
Platform:

All
Impacts:

None
Since Version:

NA
Source Control Link:

https://github.com/apache/cassandra/commit/a92de92b8c7628d9fb5085a4549ce9264ec05097
Test and Documentation Plan:

Hide

run CI

Show
run CI

Description

https://nvd.nist.gov/vuln/detail/CVE-2023-6481

A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

Attachments

Activity

People

Assignee:: Brandon Williams

Reporter:: Brandon Williams

Authors:: Brandon Williams

Reviewers:: Stefan Miklosovic

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Created:: 08/Dec/23 11:49

Updated:: 26/Mar/24 10:38

Resolved:: 08/Dec/23 14:57