CVE-2017-5929 (Critical) detected in logback-core-1.1.7.jar, logback-classic-1.1.7.jar

[mend-bolt-for-github]

CVE-2017-5929 - Critical Severity Vulnerability

Vulnerable Libraries - logback-core-1.1.7.jar, logback-classic-1.1.7.jar

logback-core-1.1.7.jar

logback-core module

Library home page: http://logback.qos.ch

Path to dependency file: /pom.xml

Path to vulnerable library: /root/.m2/repository/ch/qos/logback/logback-core/1.1.7/logback-core-1.1.7.jar

Dependency Hierarchy:

• tess4j-3.2.1.jar (Root Library)
  • logback-classic-1.1.7.jar
    • ❌ logback-core-1.1.7.jar (Vulnerable Library)

logback-classic-1.1.7.jar

logback-classic module

Library home page: http://logback.qos.ch

Path to dependency file: /pom.xml

Path to vulnerable library: /root/.m2/repository/ch/qos/logback/logback-classic/1.1.7/logback-classic-1.1.7.jar

Dependency Hierarchy:

• tess4j-3.2.1.jar (Root Library)
  • ❌ logback-classic-1.1.7.jar (Vulnerable Library)

Found in HEAD commit: 8d8753ec3a9b63366b607fac3f3b5a9fdd1d3097

Vulnerability Details

QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.

Publish Date: 2017-03-13

URL: CVE-2017-5929

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5929

Release Date: 2017-03-13

Fix Resolution (ch.qos.logback:logback-classic): 1.2.0

Direct dependency fix Resolution (net.sourceforge.tess4j:tess4j): 3.2.2

---

Step up your Open Source Security Game with Mend here