CVE-2021-42550 — RCE from attacker with configuration edit priviledges through JNDI lookup

Affected: QOS.ch logback

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.

USN-7616-1 — logback vulnerabilities

Affected: Ubuntu:Pro:16.04:LTS: logback, Ubuntu:Pro:18.04:LTS: logback, Ubuntu:Pro:20.04:LTS: logback, Ubuntu:Pro:22.04:LTS: logback

It was discovered that logback could read malicious configuration files from LDAP servers. An attacker with the required permissions could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-42550) It was discovered that logback contained a serialization vulnerability. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-6378)

Most recent entries from all

CVE-2021-42550 — RCE from attacker with configuration edit priviledges through JNDI lookup

USN-7616-1 — logback vulnerabilities