[CASSANDRA-15829] Upgrade to logback 1.2.3 to address CVE-2017-5929

• Type: Bug
• Status: Resolved
• Priority: High
• Resolution: Duplicate
• Fix Version/s: 2.2.x, 3.0.26, 3.11.12
• Component/s: Dependencies
• Bug Category: Security - Remote Code Execution
• Severity: Critical
• Complexity: Low Hanging Fruit
• Discovered By: User Report
• Platform: All
• Impacts: Security
• Assignee: Unassigned
• Reporter: Kevin Eveker
• Created: 21/May/20 22:58
• Updated: 17/Feb/22 08:13
• Resolved: 23/Sep/21 14:02

Description

Recent scan results identified the following CVE that requires this upgrade to address

https://nvd.nist.gov/vuln/detail/CVE-2017-5929

Issue Links

• is duplicated by: CASSANDRA-15421 CVE-2017-5929 in 3.11.x (QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.)
• is duplicated by: CASSANDRA-15411 [9.8] [CVE-2017-5929] [Cassandra] [2.2.5]