CVE-2023-6378: qos logback Deserialization of Untrusted Data
CVSS: 7.5v3.1HighModified
AliasesUBUNTU-CVE-2023-6378DEBIAN-CVE-2023-6378CGA-33w4-rx8g-fg34CGA-665j-vrhq-fgm6CGA-686r-473g-6p49CGA-693h-cjg8-vmcjCGA-6rhr-f4pj-4q8fCGA-6wv3-8wcv-w9wpCGA-7q78-w9w9-hwqwCGA-7q7w-pfmg-2phxCGA-89m2-fcwx-34c4CGA-cc96-mhhj-8r79CGA-fc7w-g9cj-fx6wCGA-ffwf-r69g-gw2gCGA-fg4q-6hwg-qvvxCGA-g35v-hw4v-p4x6CGA-j3r6-7xgv-mj3hCGA-jrww-qrg5-c76pCGA-mf58-3m8v-mhm2CGA-p6h6-c2fm-cx56CGA-p8hq-x73f-jqjxCGA-q2hg-25g2-rr93CGA-q5g6-8j65-chxhCGA-q944-hqvf-cc9xCGA-qhj2-54r4-63f9CGA-rxf3-m3cv-cfg4CGA-v3fc-2jq7-5m37CGA-wjqv-7vgx-fm93CGA-22r2-xj2w-2c98CGA-2fx4-vc38-qq4vCGA-2fxq-hpv4-42fpCGA-2jh7-mfv4-fp37CGA-2w46-77xr-cjg9CGA-2wm6-5qx6-fpj4CGA-2x9p-9mc4-2g6gCGA-3357-2c6p-8mg8CGA-3388-xfph-4533CGA-33hw-765j-96vcCGA-33qg-64gm-w89cCGA-38wg-2qmc-gmprCGA-392p-mqp8-55m6CGA-3c72-5rmq-83pmCGA-3hpg-hrpg-632fCGA-4977-w6xp-2hphCGA-4pc8-2875-w5j2CGA-4qfx-2f3w-65v7CGA-4qq7-vx67-7m75CGA-4xvw-mr9f-ph52CGA-5fcj-hhh7-f898CGA-5hmr-9f4q-mc98CGA-5rw3-2ppj-5279CGA-5v25-f6r5-vwwhCGA-6239-vvfj-gfh4CGA-66w4-hfp7-xv6wCGA-6c26-62qf-54g3CGA-6vpv-mx7p-4j29CGA-6x6h-8h2h-96hgCGA-749r-fwh5-2j77CGA-74wc-4842-cqxwCGA-7735-5g8m-c68hCGA-79c3-84m4-5pxmCGA-7j9j-m9qm-7vx3CGA-7vf3-jvq7-65qqCGA-85wr-7rpj-3p37CGA-882v-3f3h-fx3pCGA-8mcx-pmj3-f9g2CGA-9633-ccrw-qmjhCGA-99ph-rvwq-qgvxCGA-9f89-w6r6-5qjvCGA-9ffg-7mwg-6pj8CGA-c2gg-3c3p-7cg9CGA-c3hh-r36q-8fp3CGA-ccqq-fjvc-cxrqCGA-cg8c-jxmc-rwcxCGA-cgwm-rh4h-3j74CGA-cw95-fxxf-p4rcCGA-f393-h5rq-x3jmCGA-f993-86fq-c569CGA-fg2r-q4x9-xhq6CGA-fjm5-3m75-9x5pCGA-fm74-v9qr-q5jmCGA-fm92-jjxp-86jvCGA-g4xx-67x3-q8mcCGA-ggrw-5hvh-j8xjCGA-gqcv-jm5r-v925CGA-gv68-fpgm-hpqxCGA-hj9w-92v7-mrg6CGA-hmc4-3v2f-8m87CGA-hpqq-r3c6-6crmCGA-hrr3-2rxm-fmxjCGA-hvm7-jmj7-m4gfCGA-j6hf-x825-hq8mCGA-jqww-992f-hcc2CGA-jx63-f4pw-mf9wCGA-jxh6-25qw-jfjcCGA-m7wc-xpj5-r87pCGA-m828-4vvx-c45cCGA-mcfq-4rp7-f3pjCGA-mv6p-xpr8-542rCGA-p55v-rff9-5527CGA-p6fj-h237-7q54CGA-p6vq-7rpj-7xv6CGA-p77q-rmww-fh7gCGA-p86w-g8hx-j5x2CGA-pff7-x7v2-4mqhCGA-prw7-83ff-crw4GHSA-vmq6-5m68-f53mCGA-q2w9-4vrj-qqc5CGA-q3mh-8mmq-82v6CGA-q468-xfgv-xvf8CGA-qppq-4667-cchpCGA-qpvv-jm5m-p52cCGA-qrx3-wxmq-mrwhCGA-qwcj-xg56-fj9qCGA-qx3q-q592-7h6pCGA-qxwp-vch5-vp22CGA-r7x7-7qh8-73xxCGA-rm2m-3vh7-8m6xCGA-rv5m-6879-9g8xCGA-v326-q288-q62xCGA-v7gr-gh3f-6547CGA-vg5f-f52g-77c8CGA-vgv6-p9gr-2p89CGA-vhrc-p58w-p8f2CGA-vjw3-8q8g-93pmCGA-w64h-7x9m-gc2rCGA-w9g2-3vrw-w9mcCGA-wcv4-jq33-q49mCGA-wj2j-r7hm-275fCGA-wq95-7rv5-h2w3CGA-wvgv-8xcg-5fxmCGA-wvqf-3h95-xv5qCGA-x2mh-x2v4-vc3gCGA-x8pr-wq85-7h23CGA-x96q-8vv5-wv65CGA-xfqq-3p3x-cx3cCGA-xp63-hrmc-ph3fCGA-xrqg-qchw-rq83CGA-xx94-gc65-qgqm
Published 29-11-2023Last modified 29-11-2024
Vulnerability summary
CVE-2023-6378 is a high (CVSS 7.5) Deserialization of Untrusted Data vulnerability in qos logback. EPSS estimates a 0.90% chance of exploitation in the next 30 days, higher than 58.9% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
0.90%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 10Timeline
- 29-11-2023PublishedVulnerability first disclosed.
- 29-11-2024Last modifiedVulnerability information updated.
Description
A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSources7 sources · 7.1–7.5
- CVE.orgCNA7.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HDiffers
- OSV · ChainguardEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HDiffers
- OSV · MavenEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HDiffers
EPSS trend
Probability
0.90%
Chance of exploitation in the next 30 days
Percentile
59%
Versus all other CVEs
30-day change
0.00 pp
From 0.90% on 19-09-2026
19-09-202619-10-2026
EPSS score0.90%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard40 products
- cassandra-4.0All versions (No fix recorded)
- cassandra-4.1All versions (No fix recorded)
- cassandra-4.1-compatAll versions (No fix recorded)
- cassandra-4.1-iamguarded-compatAll versions (No fix recorded)
- cassandra-5.0All versions (No fix recorded) | < 5.0.6-r3
Wolfi10 products
- cassandra-4.1All versions (No fix recorded)
- cassandra-4.1-compatAll versions (No fix recorded)
- cassandra-5.0All versions (No fix recorded) | < 5.0.6-r3
- cassandra-5.0-compatAll versions (No fix recorded)
- cassandra-5.0-entrypoint-compatAll versions (No fix recorded)
Ch.qos.logback2 products
- logback-classic≥ 1.3.0, < 1.3.12 | ≥ 1.4.0, < 1.4.12 | < 1.2.13
- logback-core≥ 1.3.0, < 1.3.12 | ≥ 1.4.0, < 1.4.12 | < 1.2.13
Debian1 product
- logbackAll versions (No fix recorded) | < 1:1.2.11-5
Qos1 product
- logback≥ 1.2.0, < 1.2.13 | ≥ 1.3.0, < 1.3.12 | ≥ 1.4.0, < 1.4.12
Ubuntu1 product
- logback< 1:1.1.3-2ubuntu0.1~esm1 | < 1:1.2.3-2ubuntu1~18.04.1+esm1 | < 1:1.2.3-5ubuntu0.1~esm1 | < 1:1.2.10-1ubuntu0.1~esm1
6 vendors · 55 products
References
16 links
- github.com/qos-ch/logbackPACKAGE