CVE-2017-5929

Aliases:GHSA-vmfg-rjjm-rjrjDEBIAN-CVE-2017-5929CGA-23j9-qrhw-x6w9CGA-2xhm-9gf2-v2gfCGA-37gr-2vgv-cjfhCGA-498x-wm3w-8wx7CGA-4f23-337c-34mjCGA-5282-mxv8-p3jgCGA-5ggp-gx65-m5gjCGA-5w6p-j6x9-8gcgCGA-5wjm-j43g-v538CGA-6fc6-j8fh-2qxmCGA-7cxf-7hc3-2p6pCGA-8qj2-pj86-fv4xCGA-c9fr-8j67-7vj3CGA-fcpq-3f4p-6vf5CGA-fmjq-gm93-3hqqCGA-jf4p-f2cj-xwwfCGA-jr67-9gvm-4mjqCGA-mg3w-4xq9-vfjgCGA-p356-qvrc-mfqvCGA-q77p-98qf-84mfCGA-qcr9-9fgm-qhv8CGA-r4vg-xpcp-hg8pCGA-rc4p-mf98-f8g6CGA-v325-697r-g5r7CGA-vrm8-cxrw-hwx2CGA-x5xp-hpvh-99cpCGA-xvj4-7pvh-fgr2CGA-xxgp-xg38-wr92CGA-2gc7-jw9q-38c8CGA-3cvp-75c7-r486CGA-3ww9-grgx-7mh6CGA-62m6-hxxx-qvvfCGA-6gm2-xfrm-8mx5CGA-8ghx-2xmj-696wCGA-g3p3-gpv6-5w6gCGA-gfxf-gmwc-vm2hCGA-gg9f-m8mq-g4x8CGA-hw3q-qm9g-8844CGA-m8x9-fx3v-5v92CGA-pmcf-w4f4-xh94CGA-pr67-ww94-25p9CGA-rhh8-m3m4-rqgxCGA-x7c4-c4mw-45mjCGA-3jxj-554c-9jp8CGA-45p9-x7cp-694fCGA-68p5-qjr6-x4gpCGA-8h4f-fpx3-65x2CGA-c6vw-xfp7-q5hxCGA-cj4x-x85r-m68cCGA-f638-xmqw-rfc7CGA-fgvg-grm7-jx83CGA-fr52-47w7-8jj4CGA-gfr6-3rv5-x5pgCGA-h864-xcr8-qh5fCGA-hxwg-qhjv-rrv4CGA-jf42-875m-f78gCGA-m5ph-2xv2-25q8CGA-m66p-q3xx-pvhqCGA-p579-fv9f-3742CGA-qppx-vpj7-f7ggCGA-v7mp-j7gp-7pg5CGA-vwqj-vm8j-r625CGA-w4xm-5243-vxr4CGA-w586-2236-hpp8CGA-x2fg-gq5q-5qf4CGA-334w-98gx-5cjxCGA-6rcx-v253-g2wrCGA-6xvv-7xm6-pxv6CGA-92m7-8c43-64hwCGA-gxgh-wxvh-6629CGA-pr5j-xhmq-77gpCGA-qm7g-824f-qhhgCGA-qv73-cr8c-582qCGA-r4vv-mq7w-3qjfCGA-rm38-fvjr-wjh3CGA-vh6r-wh48-qh2hCGA-vm5j-3f8g-j775CGA-wvv2-r7gj-v2fwCGA-wx9r-gmhx-mpwxCGA-xv4h-4727-hf8c
Advisory lineage Upstream: 0 Downstream: 6
Modified
Published: 13 Mar 2017, 06:14
Last modified:05 Aug 2024, 15:18

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (nvd)
EPSS Score
7.5% LOW
8% probability -6.19%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

13 Mar 2017, 06:14
Published
Vulnerability first disclosed
05 Aug 2024, 15:18
Last Modified
Vulnerability information updated

Description

QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v3.0•CRITICAL•Score: 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 7.50%• Percentile: 94%

Techniques & Countermeasures

  • CWE-502•Deserialization of Untrusted Data

    The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected Systems

  • chainguard•eco-java-gradle-1.11

    all

  • chainguard•eco-java-gradle-2.0

    all

  • chainguard•eco-java-gradle-2.1

    all

  • chainguard•eco-java-gradle-2.10

    all

  • chainguard•eco-java-gradle-2.11

    all

  • chainguard•eco-java-gradle-2.12

    all

  • chainguard•eco-java-gradle-2.13

    all

  • chainguard•eco-java-gradle-2.14

    all

  • chainguard•eco-java-gradle-2.14.1

    all

  • chainguard•eco-java-gradle-2.2

    all

  • chainguard•eco-java-gradle-2.2.1

    all

  • chainguard•eco-java-gradle-2.3

    all

  • chainguard•eco-java-gradle-2.4

    all

  • chainguard•eco-java-gradle-2.5

    all

  • chainguard•eco-java-gradle-2.6

    all

  • chainguard•eco-java-gradle-2.7

    all

  • chainguard•eco-java-gradle-2.8

    all

  • chainguard•eco-java-gradle-2.9

    all

  • chainguard•hadoop-fips-3.4.2

    all

  • chainguard•hadoop-fips-3.5

    all | < 3.5.0-r12

  • debian•logback

    < 1:1.1.9-3 | < 1:1.1.9-3 | < 1:1.1.9-3 | < 1:1.1.9-3

  • ch.qos.logback•logback-classic

    < 1.2.0

  • ch.qos.logback•logback-core

    < 1.2.0

  • qos•logback

    < 1.2.0

  • redhat•satellite

    6.4

  • redhat•satellite_capsule

    6.4

References (42)