[CASSANDRA-19142] logback-core-1.2.12.jar vulnerability: CVE-2023-6378

• Type: Bug
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 3.0.30, 3.11.17, 4.0.12, 4.1.4, 5.0-beta2, 5.0
• Component/s: Dependencies
• Bug Category: Security - Denial of Service
• Severity: Normal
• Complexity: Normal
• Discovered By: User Report
• Platform: All
• Since Version: NA

Source Control Link

https://github.com/apache/cassandra/commit/a1421ec324e4bf8ab46df2a72af298f9286e0d59

Test and Documentation Plan

run CI, dependency-check

• Assignee: Brandon Williams
• Reporter: Brandon Williams

Authors

Brandon Williams

Reviewers

Stefan Miklosovic

• Created: 01/Dec/23 11:58
• Updated: 26/Mar/24 10:38
• Resolved: 06/Dec/23 12:43

Description

https://nvd.nist.gov/vuln/detail/CVE-2023-6378

A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.