CVE-2023-6378 (High) detected in logback-classic-1.4.1.jar

[mend-bolt-for-github]

CVE-2023-6378 - High Severity Vulnerability

Vulnerable Library - logback-classic-1.4.1.jar

logback-classic module

Library home page: http://logback.qos.ch

Dependency Hierarchy:

• webdocs-actuator-0.1.0-SNAPSHOT.jar (Root Library)
  • webdocs-commons-0.1.0-SNAPSHOT.jar
    • spring-boot-starter-actuator-2.7.5.jar
      • spring-boot-starter-2.7.5.jar
        • spring-boot-starter-logging-2.7.5.jar
          • ❌ logback-classic-1.4.1.jar (Vulnerable Library)

Found in HEAD commit: 2cda59cc9ba15234ad74bb5750717c564aad3b18

Found in base branch: master

Vulnerability Details

A serialization vulnerability in logback receiver component part of
logback version 1.4.11 allows an attacker to mount a Denial-Of-Service
attack by sending poisoned data.

Publish Date: 2023-11-29

URL: CVE-2023-6378

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://logback.qos.ch/news.html#1.3.12

Release Date: 2023-11-29

Fix Resolution: ch.qos.logback:logback-classic:1.3.12,1.4.12

---

Step up your Open Source Security Game with Mend here

[github-actions]

Thank you for opening an issue. If this issue is related to a bug, please follow the steps and provide the information outlined in the Troubleshooting Guide. Failure to follow these instructions may result in automatic closing of this issue.