Logback "receiver" DOS vulnerability CVE-2023-6378 incomplete fix
En bref
Sévérité
HIGH 7.1
EPSS
EPSS 0.68 % · centile 52 (2026-10-27)
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
NCSC.ch
Statut NVD
Modified
Description
A serialization vulnerability in logback receiver component part of
logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service
attack by sending poisoned data.
Scores
Version
Score
Vecteur
Évalué par
CVSS 3.1
HIGH 7.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
NCSC.ch
CVSS 3.1
HIGH 7.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
NVD · vulnerability@ncsc.ch (Secondary)
CVSS 3.1
HIGH 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD · nvd@nist.gov (Primary)
Avis
GHSA-gm62-rw4g-vrc4 — Logback is vulnerable to an attacker mounting a Denial-Of-Service attack by sending poisoned data
