CVE-2018-8088
Critical
Description
org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Qos Slf4j
PublishedMar 20, 2018
First seenMar 20, 2018
How to fix
Update
- qos slf4j1.7.26 or later
- oracle goldengate_stream_analytics19.1.0.0.1 or later
- org.slf4j:slf4j-ext1.7.26, 1.8.0-beta4 or later
Vendor advisories
- access.redhat.com/errata/RHSA-2018:1448
- access.redhat.com/errata/RHSA-2018:1449
- access.redhat.com/errata/RHSA-2018:1248
- access.redhat.com/errata/RHSA-2018:1251
- access.redhat.com/errata/RHSA-2018:2143
- access.redhat.com/errata/RHSA-2018:1450
- access.redhat.com/errata/RHSA-2018:2669
- access.redhat.com/errata/RHSA-2018:1323
- access.redhat.com/errata/RHSA-2018:2420
- access.redhat.com/errata/RHSA-2018:0630
- access.redhat.com/errata/RHSA-2018:1525
- access.redhat.com/errata/RHSA-2018:1575
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| qos slf4j | v < 1.7.26, 1.8.0 | 1.7.26 |
| redhat jboss_enterprise_application_platform | 7.1, 6.0.0, 6.4.0 | — |
| redhat virtualization | 4.0 | — |
| redhat virtualization_host | 4.0 | — |
| redhat enterprise_linux_desktop | 7.0 | — |
| redhat enterprise_linux_eus | 7.4, 7.5, 7.6, 7.7 | — |
| redhat enterprise_linux_server | 7.0 | — |
| redhat enterprise_linux_server_aus | 7.4, 7.6, 7.7 | — |
| redhat enterprise_linux_server_tus | 7.4, 7.6, 7.7 | — |
| redhat enterprise_linux_workstation | 7.0 | — |
| oracle goldengate_application_adapters | 12.3.2.1.0 | — |
| oracle goldengate_stream_analytics | v < 19.1.0.0.1 | 19.1.0.0.1 |
| oracle utilities_framework | 4.2.0.2.0, 4.2.0.3.0, 4.3.0.2.0, 4.3.0.3.0, 4.3.0.4.0, 4.3.0.5.0, 4.3.0.6.0, 4.4.0.0.0 | — |
| org.slf4j:slf4j-extMaven | v < 1.7.26, 1.8.0-alpha0 ≤ v < 1.8.0-beta4 | 1.7.26, 1.8.0-beta4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.