正文

QOS.CH SLF4J slf4j-ext模块代码问题漏洞

admin
admin V管理员 /0 评论 /13 阅读
0212
此篇文章发布距今已超过1226天，您需要注意文章的内容或图片是否可用！

漏洞信息详情

QOS.CH SLF4J slf4j-ext模块代码问题漏洞

  • CNNVD编号：CNNVD-201803-708
    • <!--
  • 危害等级： 超危-->
  • 危害等级： 超危
  • CVE编号： CVE-2018-8088
  • 漏洞类型： 代码问题
  • 发布时间： 2018-03-21
  • 威胁类型： 远程
  • 更新时间： 2021-10-20
  • 厂        商： slf4j
  • 漏洞来源： Chris McCown,Red H...

漏洞简介

SLF4J是开源的一个库，充当各种日志框架（例如 java.util.logging、logback、log4j）的简单外观或抽象。

SLF4J 1.8.0-beta2之前版本中的slf4j-ext模块的org.slf4j.ext.EventData存在代码问题漏洞。远程攻击者可借助特制的数据利用该漏洞绕过访问限制。

漏洞公告

目前厂商已发布升级补丁以修复漏洞，补丁获取链接：

https://github.com/qos-ch/slf4j/commit/d2b27fba88e983f921558da27fc29b5f5d269405

参考网址

来源:BID

链接:http://www.securityfocus.com/bid/103737

来源:www.oracle.com

链接:https://www.oracle.com/technetwork/topics/security/linuxbulletinapr2018-4431087.html

来源:www.oracle.com

链接:https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

来源:www.slf4j.org

链接:https://www.slf4j.org/

来源:jira.qos.ch

链接:https://jira.qos.ch/browse/SLF4J-430

来源:access.redhat.com

链接:https://access.redhat.com/security/cve/cve-2018-8088

来源:bugzilla.redhat.com

链接:https://bugzilla.redhat.com/show_bug.cgi?id=1548909

来源:MLIST

链接:https://lists.apache.org/thread.html/r2d05924f903403927a2f4e78d9b1249a42f0bd09f69a7c1954d74a42@%3Creviews.iotdb.apache.org%3E

来源:BID

链接:https://www.securityfocus.com/bid/103737

来源:MLIST

链接:https://lists.apache.org/thread.html/r9e25496608036573736cee484d8d03dae400f09e443b0000b6adc042@%3Ccommits.iotdb.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/r32be21da011479df41468a62bc09d12f0d3b4e3a71679d33cb0e8c56@%3Cissues.zookeeper.apache.org%3E

来源:MISC

链接:https://www.oracle.com/security-alerts/cpuoct2020.html

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2018:2669

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2018:1575

来源:SECTRACK

链接:http://www.securitytracker.com/id/1040627

来源:MLIST

链接:https://lists.apache.org/thread.html/rd86db9679150e9297b5c0fcb6f0e80a8b81b54fcf423de5a914bca78@%3Ccommon-commits.hadoop.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/rfb45527bad7220ada9e30957762e1da254ce405e67cc3ddf6f3558d9@%3Creviews.iotdb.apache.org%3E

来源:MISC

链接:https://jira.qos.ch/browse/SLF4J-431

来源:MLIST

链接:https://lists.apache.org/thread.html/reb3eeb985afdead17fadb7c33d5d472c1015a85ea5c9b038ec77f378@%3Ccommon-dev.hadoop.apache.org%3E

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2018:0582

来源:MLIST

链接:https://lists.apache.org/thread.html/r0f376559fd39cf1a53ac3afbc1fc5d62649dcac9916d4697445a94fa@%3Cissues.zookeeper.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/r17e7e6abc53d29c0e269153517d36f4bec2755b95900596e6df15cbe@%3Cnotifications.iotdb.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/r37644f0a00aca9fbcbc21c0f9a91f927b63153ec3607be469cd515e5@%3Creviews.iotdb.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/raabf1a00b2652575fca9fcb44166a828a0cab97a7d1594001eabc991@%3Ccommon-issues.hadoop.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/956ba8e76b6793a6670b2eb0129a5e3003ce2124ca3130fd57d48d0f@%3Cdevnull.infra.apache.org%3E

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2019:3140

来源:MLIST

链接:https://lists.apache.org/thread.html/r9584c4304c888f651d214341a939bd264ed30c9e3d0d30fe85097ecf@%3Ccommits.pulsar.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/r573eb577a67503e72181eee637d9b0ac042197e632bcdfce76af06a3@%3Cissues.flink.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/r767861f053c15f9e9201b939a0d508dd58475a072e76135eaaca17f0@%3Ccommon-issues.hadoop.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/r48247c12cf652e95a01fc94ee5aa8641f3ec481235774790e53eb55e@%3Creviews.iotdb.apache.org%3E

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2018:0592

来源:MLIST

链接:https://lists.apache.org/thread.html/95ce76613c869dbccf1d3d29327099ccc71aeec156f76c30853044fa@%3Cdevnull.infra.apache.org%3E

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2019:2413

来源:MLIST

链接:https://lists.apache.org/thread.html/r5cf87a035b297c19f4043a37b73c341576dd92f819bd3e4aa27de541@%3Cissues.flink.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/r81711cde77c2c5742b7b8533c978e79771b700af0ef4d3149d70df25@%3Cnotifications.logging.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/r891761d5014f9ffd79d9737482de832462de538b6c4bdcef21aad729@%3Cissues.flink.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/rfe52b7cbba4dcba521e13130e5d28d5818b78d70db0af1b470fa0264@%3Ccommon-issues.hadoop.apache.org%3E

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2018:0628

来源:MISC

链接:https://github.com/qos-ch/slf4j/commit/d2b27fba88e983f921558da27fc29b5f5d269405

来源:MLIST

链接:https://lists.apache.org/thread.html/r1660c72a660f0522947ca6ce329dcc74e1ee20c58bbe208472754489@%3Ccommon-issues.hadoop.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2018:0629

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2018:0627

来源:MLIST

链接:https://lists.apache.org/thread.html/rc378b97d52856f9f3c5ced14771fed8357e4187a3a0f9a2f0515931a@%3Cissues.zookeeper.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/rc7de83170d3402af15bfed3d59f80aea20f250535bdce30e4cad24db@%3Cissues.flink.apache.org%3E

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2018:2420

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2018:1450

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2018:1451

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2018:2143

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2018:1251

来源:MLIST

链接:https://lists.apache.org/thread.html/r99a6552e45ca6ba1082031421f51799a4a665eda905ab2c2aa9d6ffa@%3Cdev.flink.apache.org%3E

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2018:1449

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2018:1249

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2018:1447

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2018:1448

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2018:1525

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2018:1247

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2018:1248

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2018:2930

来源:MLIST

链接:https://lists.apache.org/thread.html/re6fb6b0de9d679310437ff87fc94e39da5a14dce9c73864a41837462@%3Ccommon-commits.hadoop.apache.org%3E

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2018:0630

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2018:1323

来源:MLIST

链接:https://lists.apache.org/thread.html/rf58e1bee31d66665437dde9acd9abed53f8483034b69fa9ca7cde09c@%3Cdev.zookeeper.apache.org%3E

来源:REDHAT

链接:https://access.redhat.com/errata/RHSA-2018:2419

来源:MISC

链接:https://www.oracle.com/security-alerts/cpujul2020.html

来源:access.redhat.com

链接:https://access.redhat.com/errata/RHSA-2019:2413

来源:access.redhat.com

链接:https://access.redhat.com/errata/RHSA-2019:3140

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/153980/Red-Hat-Security-Advisory-2019-2413-01.html

来源:www.oracle.com

链接:https://www.oracle.com/security-alerts/cpuoct2020.html

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2020.2071/

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/154906/Red-Hat-Security-Advisory-2019-3140-01.html

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2019.3040/

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2019.3899/

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/158096/Red-Hat-Security-Advisory-2020-2561-01.html

来源:www.oracle.com

链接:https://www.oracle.com/security-alerts/cpuoct2021.html

来源:www.cybersecurity-help.cz

链接:https://www.cybersecurity-help.cz/vdb/SB2021101936

来源:www.ibm.com

链接:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-dependent-libraries-affect-ibm-db2-leading-to-denial-of-service-or-privilege-escalation-4/

来源:www.securityfocus.com

链接:https://www.securityfocus.com/bid/103737

受影响实体

  • Slf4j Slf4j:1.8.0:Alpha0  
    <!--
    2000-1-1
    -->
  • Slf4j Slf4j:1.8.0:Alpha1  
    <!--
    2000-1-1
    -->
  • Slf4j Slf4j:1.8.0:Alpha2  
    <!--
    2000-1-1
    -->
  • Slf4j Slf4j:1.8.0:Beta0  
    <!--
    2000-1-1
    -->
  • Slf4j Slf4j:1.8.0:Beta1  
    <!--
    2000-1-1
    -->

补丁

  • QOS.CH SLF4J slf4j-ext模块安全漏洞的修复措施
    <!--
    2018-3-21
    -->