正文

QOS.ch Logback SocketServer和ServerSocketReceiver组件代码问题漏洞

admin
admin V管理员 /0 评论 /13 阅读
0113
此篇文章发布距今已超过1224天，您需要注意文章的内容或图片是否可用！

漏洞信息详情

QOS.ch Logback SocketServer和ServerSocketReceiver组件代码问题漏洞

  • CNNVD编号：CNNVD-201703-531
    • <!--
  • 危害等级： 超危-->
  • 危害等级： 超危
  • CVE编号： CVE-2017-5929
  • 漏洞类型： 代码问题
  • 发布时间： 2017-03-14
  • 威胁类型： 远程
  • 更新时间： 2021-09-24
  • 厂        商： logback
  • 漏洞来源： Red Hat

漏洞简介

QOS.ch Logback是一套使用Java编写的日志框架。SocketServer和ServerSocketReceiver都是其中的调试模块。

QOS.ch Logback 1.1.10及之前的版本中的SocketServer和ServerSocketReceiver组件存在安全漏洞。攻击者可利用该漏洞获取提升的权限。

漏洞公告

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接：

https://logback.qos.ch/news.html

参考网址

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2017:1676

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2017:1675

来源:MLIST

链接:https://lists.apache.org/thread.html/r4673642893562c58cbee60c151ded6c077e8a2d02296e862224a9161@%3Ccommits.cassandra.apache.org%3E

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2017:1832

来源:MLIST

链接:https://lists.apache.org/thread.html/rd2227af3c9ada2a72dc72ed05517f5857a34d487580e1f2803922ff9@%3Ccommits.cassandra.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/r718f27bed898008a8e037d9cc848cfc1df4d18abcbaee0cb0c142cfb@%3Ccommits.cassandra.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/rc5f0cc2f3b153bdf15ee7389d78585829abc9c7af4d322ba1085dd3e@%3Ccommits.cassandra.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/r967953a14e05016bc4bcae9ef3dd92e770181158b4246976ed8295c9@%3Cdev.brooklyn.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/r2c2d57ca180e8173c90fe313ddf8eabbdcf8e3ae196f8b9f42599790@%3Ccommits.mnemonic.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/r397bf63783240fbb5713389d3f889d287ae0c11509006700ac720037@%3Ccommits.cassandra.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/ra007cec726a3927c918ec94c4316d05d1829c49eae8dc3648adc35e2@%3Ccommits.cassandra.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/r0bb19330e48d5ad784fa20dacba9e5538d8d60f5cd9142e0f1432b4b@%3Ccommits.cassandra.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/r2a08573ddee4a86dc96d469485a5843a01710ee0dc2078dfca410c79@%3Ccommits.cassandra.apache.org%3E

来源:CONFIRM

链接:https://logback.qos.ch/news.html

来源:MLIST

链接:https://lists.apache.org/thread.html/fa4eaaa6ff41ac6f79811e053c152ee89b7c5da8a6ac848ae97df67f@%3Ccommits.cassandra.apache.org%3E

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2018:2927

来源:MLIST

链接:https://lists.apache.org/thread.html/rbb4dfca2f7e3e8f3570eec21c79832d33a51dfde6762725660b60169@%3Cdev.mnemonic.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/18d509024d9aeb07f0e9579066f80bf5d4dcf20467b0c240043890d1@%3Ccommits.cassandra.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/a6db61616180d73711d6db25703085940026e2dbc40f153f9d22b203@%3Ccommits.cassandra.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/r632ec30791b441e2eb5a3129532bf1b689bf181d0ef7daf50bcf0fd6@%3Ccommits.cassandra.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/re9b787727291786dfe088e3cd078c7d195c0b5781e15d3cd24a3b2fc@%3Cdev.mnemonic.apache.org%3E

来源:www.ibm.com

链接:https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-open-source-logback-used-in-ibm-cloud-pak-system/

来源:www.nsfocus.net

链接:http://www.nsfocus.net/vulndb/48071

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2020.1076/

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/156941/Red-Hat-Security-Advisory-2020-0983-01.html

受影响实体

  • Logback Logback:1.1.10  
    <!--
    2000-1-1
    -->

补丁

  • QOS.ch Logback SocketServer和ServerSocketReceiver组件安全漏洞的修复措施
    <!--
    2017-3-14
    -->