Bug 1432858 (CVE-2017-5929)

Summary: CVE-2017-5929 logback: Serialization vulnerability in SocketServer and ServerSocketReceiver
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aileenc, alazarot, bcourt, bkearney, cbillett, chazlett, drieden, etirelli, ggaughan, janstey, jcoleman, jmatthew, jochrist, jshepherd, kverlaen, lpetrovi, mbaluch, mmccune, mstead, mwinkler, nwallace, ohadlevy, rrajasek, rzhang, tkirby, tlestach, tomckay, tsanders
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: logback-classic 1.2.0 Doc Type: Bug Fix
Doc Text:
It was found that logback is vulnerable to a deserialization issue. Logback can be configured to allow remote logging through SocketServer/ServerSocketReceiver interfaces that can accept untrusted serialized data. Authenticated attackers on the adjacent network can leverage this vulnerability to execute arbitrary code through deserialization of custom gadget chains.
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 03:09:00 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1471347    
Bug Blocks: 1432861, 1460775    

Description Andrej Nemec 2017-03-16 09:18:19 UTC
It was found that logback is vulnerable to a deserialization issue. Logback can be configured to allow remote logging through SocketServer/ServerSocketReceiver interfaces that can accept untrusted serialized data. Authenticated attackers on the adjacent network can leverage this vulnerability to execute arbitrary code through deserialization of custom gadget chains. 

References:

https://logback.qos.ch/news.html

Comment 4 Pavel Polischouk 2017-04-19 15:01:02 UTC
Upstream commit: 

https://github.com/qos-ch/logback/commit/f46044b805bca91efe5fd6afe52257cd02f775f8

Comment 5 errata-xmlrpc 2017-07-04 18:01:34 UTC
This issue has been addressed in the following products:

  Red Hat JBoss BRMS

Via RHSA-2017:1676 https://access.redhat.com/errata/RHSA-2017:1676

Comment 6 errata-xmlrpc 2017-07-04 18:02:40 UTC
This issue has been addressed in the following products:

  Red Hat JBoss BPM Suite

Via RHSA-2017:1675 https://access.redhat.com/errata/RHSA-2017:1675

Comment 8 errata-xmlrpc 2017-08-10 23:04:07 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Fuse

Via RHSA-2017:1832 https://access.redhat.com/errata/RHSA-2017:1832

Comment 10 errata-xmlrpc 2018-10-16 15:19:00 UTC
This issue has been addressed in the following products:

  Red Hat Satellite 6.4 for RHEL 7

Via RHSA-2018:2927 https://access.redhat.com/errata/RHSA-2018:2927

Comment 11 errata-xmlrpc 2018-12-03 14:57:10 UTC
This issue has been addressed in the following products:

  Red Hat Process Automation

Via RHSA-2017:1675 https://access.redhat.com/errata/RHSA-2017:1675

Comment 12 errata-xmlrpc 2018-12-03 14:57:39 UTC
This issue has been addressed in the following products:

  Red Hat Decision Manager

Via RHSA-2017:1676 https://access.redhat.com/errata/RHSA-2017:1676