{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-6481", "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c", "state": "PUBLISHED", "assignerShortName": "NCSC.ch", "dateReserved": "2023-12-04T08:34:29.742Z", "datePublished": "2023-12-04T08:35:44.396Z", "dateUpdated": "2024-08-02T08:28:21.829Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["logback receiver"], "platforms": ["Windows", "Linux", "MacOS"], "product": "logback", "repo": "https://github.com/qos-ch/logback", "vendor": "QOS.CH Sarl", "versions": [{"status": "unaffected", "version": "1.4.14"}, {"status": "unaffected", "version": "1.3.14"}, {"status": "unaffected", "version": "1.2.13"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n<pre>The attacker needs to be able to feed poisoned data to a logback receiver. Thus, the attacker needs to connect to a logback receiver which can be a significant hurdle in itself.<br>Only environments where logback receiver is deployed are vulnerable. <br></pre>\n\n"}], "value": "The attacker needs to be able to feed poisoned data to a logback receiver. Thus, the attacker needs to connect to a logback receiver which can be a significant hurdle in itself.\nOnly environments where logback receiver is deployed are vulnerable. \n\n\n\n\n"}], "credits": [{"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "Yakov Shafranovich, Amazon Web Services"}, {"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "Camilo Aparecido Ferri Moreira"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\nA serialization vulnerability in logback receiver component part of \nlogback version 1.4.13,&nbsp;1.3.13 and&nbsp;1.2.12 allows an attacker to mount a Denial-Of-Service \nattack by sending poisoned data.\n\n"}], "value": "A serialization vulnerability in logback receiver component part of \nlogback version 1.4.13,\u00a01.3.13 and\u00a01.2.12 allows an attacker to mount a Denial-Of-Service \nattack by sending poisoned data.\n\n"}], "impacts": [{"descriptions": [{"lang": "en", "value": "Excessive CPU or memory usage on the host where a logback receiver component is deployed"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"description": "Denial-of-service using poisoned data", "lang": "en"}]}], "providerMetadata": {"orgId": "455daabc-a392-441d-aa46-37d35189897c", "shortName": "NCSC.ch", "dateUpdated": "2023-12-04T08:35:44.396Z"}, "references": [{"url": "https://logback.qos.ch/news.html#1.3.12"}, {"url": "https://logback.qos.ch/news.html#1.3.14"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Only environments where logback receiver component is deployed may be vulnerable.\n In case a logback receiver is deployed, restricting connections to \ntrustworthy clients or upgrading to logback version 1.4.14, 1.3.14, 1.2.13 or later will remedy the vulnerability.<br><br>If you do not need to deploy logback-receiver, then please verify that you do not have any &lt;receiver&gt;&lt;/receiver&gt; entries in your configuration files.<br>"}], "value": "Only environments where logback receiver component is deployed may be vulnerable.\n In case a logback receiver is deployed, restricting connections to \ntrustworthy clients or upgrading to logback version 1.4.14, 1.3.14, 1.2.13 or later will remedy the vulnerability.\n\nIf you do not need to deploy logback-receiver, then please verify that you do not have any <receiver></receiver> entries in your configuration files.\n"}], "source": {"discovery": "UNKNOWN"}, "title": "Logback \"receiver\" DOS vulnerability CVE-2023-6378 incomplete fix", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Logback versions 1.2.13 and later, 1.3.14 \nand later&nbsp; or 1.4.14 \nand later\n\nprovides fixes. However, please note that these fixes are only effective when deployed under Java 9 or later.<br>"}], "value": "Logback versions 1.2.13 and later, 1.3.14 \nand later\u00a0 or 1.4.14 \nand later\n\nprovides fixes. However, please note that these fixes are only effective when deployed under Java 9 or later.\n"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:28:21.829Z"}, "title": "CVE Program Container", "references": [{"url": "https://logback.qos.ch/news.html#1.3.12", "tags": ["x_transferred"]}, {"url": "https://logback.qos.ch/news.html#1.3.14", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:qos:logback:1.2.12:*:*:*:*:*:*:*", "matchCriteriaId": "096CE0E0-9128-42CE-9047-DC0E8575920B", "vulnerable": true}, {"criteria": "cpe:2.3:a:qos:logback:1.3.13:*:*:*:*:*:*:*", "matchCriteriaId": "E9E58AB3-AC12-4C3F-A8A3-A49512F276E9", "vulnerable": true}, {"criteria": "cpe:2.3:a:qos:logback:1.4.13:*:*:*:*:*:*:*", "matchCriteriaId": "0F59BD62-E471-4F2E-A21C-DF6B5950720C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A serialization vulnerability in logback receiver component part of \nlogback version 1.4.13,\u00a01.3.13 and\u00a01.2.12 allows an attacker to mount a Denial-Of-Service \nattack by sending poisoned data.\n\n"}, {"lang": "es", "value": "Una vulnerabilidad de serializaci\u00f3n en el componente Logback Receiver. Las versiones 1.4.13, 1.3.13 y 1.2.12 de Logback permite a un atacante montar un ataque de denegaci\u00f3n de servicio enviando datos envenenados."}], "id": "CVE-2023-6481", "lastModified": "2023-12-07T19:57:46.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 4.0, "source": "vulnerability@ncsc.ch", "type": "Secondary"}]}, "published": "2023-12-04T09:15:37.250", "references": [{"source": "vulnerability@ncsc.ch", "tags": ["Release Notes"], "url": "https://logback.qos.ch/news.html#1.3.12"}, {"source": "vulnerability@ncsc.ch", "tags": ["Release Notes"], "url": "https://logback.qos.ch/news.html#1.3.14"}], "sourceIdentifier": "vulnerability@ncsc.ch", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:3354", "cpe": "cpe:/a:redhat:jboss_fuse:7", "package": "logback", "product_name": "Red Hat Fuse 7.13.0", "release_date": "2024-05-23T00:00:00Z"}, {"advisory": "RHSA-2024:2945", "cpe": "cpe:/a:redhat:amq_broker:7.12", "package": "logback", "product_name": "Red Hat JBoss A-MQ 7", "release_date": "2024-05-21T00:00:00Z"}, {"advisory": "RHSA-2024:0793", "cpe": "cpe:/a:redhat:camel_spring_boot:4.0.3", "package": "logback", "product_name": "RHINT Camel-Springboot 4.0.3", "release_date": "2024-02-12T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/client-kn-rhel8:1.10.0-5", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8:1.10.0-4", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/eventing-controller-rhel8:1.10.0-4", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/eventing-in-memory-channel-controller-rhel8:1.10.0-4", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8:1.10.0-4", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/eventing-istio-controller-rhel8:1.10.0-5", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/eventing-kafka-broker-controller-rhel8:1.10.0-3", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/eventing-kafka-broker-dispatcher-rhel8:1.10.0-3", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/eventing-kafka-broker-post-install-rhel8:1.10.0-3", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/eventing-kafka-broker-receiver-rhel8:1.10.0-3", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/eventing-kafka-broker-webhook-rhel8:1.10.0-3", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/eventing-mtbroker-filter-rhel8:1.10.0-4", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/eventing-mtbroker-ingress-rhel8:1.10.0-4", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/eventing-mtchannel-broker-rhel8:1.10.0-4", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/eventing-mtping-rhel8:1.10.0-4", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/eventing-storage-version-migration-rhel8:1.10.0-4", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/eventing-webhook-rhel8:1.10.0-4", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/func-utils-rhel8:1.31.1-2", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/ingress-rhel8-operator:1.31.1-2", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/knative-rhel8-operator:1.31.1-2", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/kn-cli-artifacts-rhel8:1.10.0-3", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/kourier-control-rhel8:1.10.0-4", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/net-istio-controller-rhel8:1.10.0-4", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/net-istio-webhook-rhel8:1.10.0-4", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/serverless-operator-bundle:1.31.1-1", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/serverless-rhel8-operator:1.31.1-2", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/serving-activator-rhel8:1.10.0-4", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/serving-autoscaler-hpa-rhel8:1.10.0-4", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/serving-autoscaler-rhel8:1.10.0-4", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/serving-controller-rhel8:1.10.0-4", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/serving-domain-mapping-rhel8:1.10.0-4", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/serving-domain-mapping-webhook-rhel8:1.10.0-4", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/serving-queue-rhel8:1.10.0-4", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/serving-storage-version-migration-rhel8:1.10.0-4", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/serving-webhook-rhel8:1.10.0-4", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1/svls-must-gather-rhel8:1.31.1-2", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1-tech-preview/eventing-istio-controller-rhel8:1.10.0-5", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8:1.10.0-4", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1-tech-preview/logic-swf-builder-rhel8:1.31.0-5", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:0843", "cpe": "cpe:/a:redhat:openshift_serverless:1.31::el8", "package": "openshift-serverless-1-tech-preview/logic-swf-devmode-rhel8:1.31.0-4", "product_name": "RHOSS-1.31-RHEL-8", "release_date": "2024-02-15T00:00:00Z"}, {"advisory": "RHSA-2024:1353", "cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7.13", "product_name": "RHPAM 7.13.5 async", "release_date": "2024-03-18T00:00:00Z"}], "bugzilla": {"description": "logback: A serialization vulnerability in logback receiver", "id": "2252956", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2252956"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-400", "details": ["A serialization vulnerability in logback receiver component part of \nlogback version 1.4.13,\u00a01.3.13 and\u00a01.2.12 allows an attacker to mount a Denial-Of-Service \nattack by sending poisoned data.", "A flaw was found in the logback package. Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') via the logback receiver component. This flaw allows an attacker to mount a denial-of-service attack by sending poisoned data."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2023-6481", "package_state": [{"cpe": "cpe:/a:redhat:a_mq_clients:2", "fix_state": "Not affected", "package_name": "logback", "product_name": "A-MQ Clients 2"}, {"cpe": "cpe:/a:redhat:logging:5", "fix_state": "Not affected", "package_name": "openshift-logging/elasticsearch6-rhel8", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:migration_toolkit_applications:6", "fix_state": "Not affected", "package_name": "logback", "product_name": "Migration Toolkit for Applications 6"}, {"cpe": "cpe:/a:redhat:migration_toolkit_applications:7", "fix_state": "Not affected", "package_name": "logback", "product_name": "Migration Toolkit for Applications 7"}, {"cpe": "cpe:/a:redhat:migration_toolkit_runtimes:1", "fix_state": "Not affected", "package_name": "logback", "product_name": "Migration Toolkit for Runtimes"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:3", "fix_state": "Out of support scope", "package_name": "logback", "product_name": "Red Hat build of Apache Camel for Spring Boot"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Not affected", "package_name": "logback", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:optaplanner:::el6", "fix_state": "Affected", "package_name": "logback", "product_name": "Red Hat build of OptaPlanner 8"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Not affected", "package_name": "ch.qos.logback/logback-core", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Will not fix", "package_name": "logback", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_brms_platform:7", "fix_state": "Affected", "package_name": "logback", "product_name": "Red Hat Decision Manager 7"}, {"cpe": "cpe:/a:redhat:integration:1", "fix_state": "Will not fix", "package_name": "logback", "product_name": "Red Hat Integration Camel K"}, {"cpe": "cpe:/a:redhat:debezium:2", "fix_state": "Will not fix", "package_name": "logback", "product_name": "Red Hat Integration Change Data Capture"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:7", "fix_state": "Will not fix", "package_name": "logback", "product_name": "Red Hat JBoss Data Grid 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6", "fix_state": "Out of support scope", "package_name": "logback", "product_name": "Red Hat JBoss Enterprise Application Platform 6"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6", "fix_state": "Out of support scope", "package_name": "org.keycloak-keycloak-parent", "product_name": "Red Hat JBoss Enterprise Application Platform 6"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Will not fix", "package_name": "logback", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Will not fix", "package_name": "logback", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Will not fix", "package_name": "logback", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6", "fix_state": "Not affected", "package_name": "logback", "product_name": "Red Hat JBoss Web Server 6"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7", "fix_state": "Affected", "package_name": "logback", "product_name": "Red Hat Process Automation 7"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Will not fix", "package_name": "logback", "product_name": "Red Hat Single Sign-On 7"}, {"cpe": "cpe:/a:redhat:openshift_application_runtimes:1.0", "fix_state": "Out of support scope", "package_name": "logback", "product_name": "Red Hat support for Spring Boot"}, {"cpe": "cpe:/a:redhat:amq_streams:1", "fix_state": "Affected", "package_name": "logback", "product_name": "streams for Apache Kafka"}], "public_date": "2023-12-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-6481\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-6481"], "statement": "The security vulnerability in the logback package is considered of moderate severity due to its potential for facilitating a denial-of-service (DoS) attack. While a DoS attack can disrupt service availability, this vulnerability may not lead to more severe consequences such as unauthorized access or data breaches.", "threat_severity": "Moderate", "upstream_fix": "logback-classic 1.2.13, logback-classic 1.3.14, logback-classic 1.4.14"}