低危 QOS.CH SLF4J slf4j-ext模块代码问题漏洞

CVE编号

CVE-2018-8088

利用情况

暂无

补丁情况

官方补丁

披露时间

2018-03-21
漏洞描述
SLF4J是开源的一个库,充当各种日志框架(例如 java.util.logging、logback、log4j)的简单外观或抽象。
SLF4J 1.8.0-beta2之前版本中的slf4j-ext模块的org.slf4j.ext.EventData存在代码问题漏洞。远程攻击者可借助特制的数据利用该漏洞绕过访问限制

解决建议
目前厂商已发布升级补丁以修复漏洞,补丁获取链接:
https://github.com/qos-ch/slf4j/commit/d2b27fba88e983f921558da27fc29b5f5d269405
参考链接
http://www.securityfocus.com/bid/103737
http://www.securitytracker.com/id/1040627
https://access.redhat.com/errata/RHSA-2018:0582
https://access.redhat.com/errata/RHSA-2018:0592
https://access.redhat.com/errata/RHSA-2018:0627
https://access.redhat.com/errata/RHSA-2018:0628
https://access.redhat.com/errata/RHSA-2018:0629
https://access.redhat.com/errata/RHSA-2018:0630
https://access.redhat.com/errata/RHSA-2018:1247
https://access.redhat.com/errata/RHSA-2018:1248
https://access.redhat.com/errata/RHSA-2018:1249
https://access.redhat.com/errata/RHSA-2018:1251
https://access.redhat.com/errata/RHSA-2018:1323
https://access.redhat.com/errata/RHSA-2018:1447
https://access.redhat.com/errata/RHSA-2018:1448
https://access.redhat.com/errata/RHSA-2018:1449
https://access.redhat.com/errata/RHSA-2018:1450
https://access.redhat.com/errata/RHSA-2018:1451
https://access.redhat.com/errata/RHSA-2018:1525
https://access.redhat.com/errata/RHSA-2018:1575
https://access.redhat.com/errata/RHSA-2018:2143
https://access.redhat.com/errata/RHSA-2018:2419
https://access.redhat.com/errata/RHSA-2018:2420
https://access.redhat.com/errata/RHSA-2018:2669
https://access.redhat.com/errata/RHSA-2018:2930
https://access.redhat.com/errata/RHSA-2019:2413
https://access.redhat.com/errata/RHSA-2019:3140
https://github.com/qos-ch/slf4j/commit/d2b27fba88e983f921558da27fc29b5f5d269405
https://jira.qos.ch/browse/SLF4J-430
https://jira.qos.ch/browse/SLF4J-431
https://lists.apache.org/thread.html/956ba8e76b6793a6670b2eb0129a5e3003ce2124...
https://lists.apache.org/thread.html/95ce76613c869dbccf1d3d29327099ccc71aeec1...
https://lists.apache.org/thread.html/r0f376559fd39cf1a53ac3afbc1fc5d62649dcac...
https://lists.apache.org/thread.html/r0f376559fd39cf1a53ac3afbc1fc5d62649dcac...
https://lists.apache.org/thread.html/r1660c72a660f0522947ca6ce329dcc74e1ee20c...
https://lists.apache.org/thread.html/r17e7e6abc53d29c0e269153517d36f4bec2755b...
https://lists.apache.org/thread.html/r17e7e6abc53d29c0e269153517d36f4bec2755b...
https://lists.apache.org/thread.html/r2d05924f903403927a2f4e78d9b1249a42f0bd0...
https://lists.apache.org/thread.html/r2d05924f903403927a2f4e78d9b1249a42f0bd0...
https://lists.apache.org/thread.html/r32be21da011479df41468a62bc09d12f0d3b4e3...
https://lists.apache.org/thread.html/r32be21da011479df41468a62bc09d12f0d3b4e3...
https://lists.apache.org/thread.html/r37644f0a00aca9fbcbc21c0f9a91f927b63153e...
https://lists.apache.org/thread.html/r37644f0a00aca9fbcbc21c0f9a91f927b63153e...
https://lists.apache.org/thread.html/r48247c12cf652e95a01fc94ee5aa8641f3ec481...
https://lists.apache.org/thread.html/r48247c12cf652e95a01fc94ee5aa8641f3ec481...
https://lists.apache.org/thread.html/r573eb577a67503e72181eee637d9b0ac042197e...
https://lists.apache.org/thread.html/r573eb577a67503e72181eee637d9b0ac042197e...
https://lists.apache.org/thread.html/r5cf87a035b297c19f4043a37b73c341576dd92f...
https://lists.apache.org/thread.html/r5cf87a035b297c19f4043a37b73c341576dd92f...
https://lists.apache.org/thread.html/r767861f053c15f9e9201b939a0d508dd58475a0...
https://lists.apache.org/thread.html/r81711cde77c2c5742b7b8533c978e79771b700a...
https://lists.apache.org/thread.html/r891761d5014f9ffd79d9737482de832462de538...
https://lists.apache.org/thread.html/r891761d5014f9ffd79d9737482de832462de538...
https://lists.apache.org/thread.html/r9584c4304c888f651d214341a939bd264ed30c9...
https://lists.apache.org/thread.html/r99a6552e45ca6ba1082031421f51799a4a665ed...
https://lists.apache.org/thread.html/r99a6552e45ca6ba1082031421f51799a4a665ed...
https://lists.apache.org/thread.html/r9e25496608036573736cee484d8d03dae400f09...
https://lists.apache.org/thread.html/r9e25496608036573736cee484d8d03dae400f09...
https://lists.apache.org/thread.html/raabf1a00b2652575fca9fcb44166a828a0cab97...
https://lists.apache.org/thread.html/rc378b97d52856f9f3c5ced14771fed8357e4187...
https://lists.apache.org/thread.html/rc378b97d52856f9f3c5ced14771fed8357e4187...
https://lists.apache.org/thread.html/rc7de83170d3402af15bfed3d59f80aea20f2505...
https://lists.apache.org/thread.html/rc7de83170d3402af15bfed3d59f80aea20f2505...
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2...
https://lists.apache.org/thread.html/rd86db9679150e9297b5c0fcb6f0e80a8b81b54f...
https://lists.apache.org/thread.html/re6fb6b0de9d679310437ff87fc94e39da5a14dc...
https://lists.apache.org/thread.html/reb3eeb985afdead17fadb7c33d5d472c1015a85...
https://lists.apache.org/thread.html/rf58e1bee31d66665437dde9acd9abed53f84830...
https://lists.apache.org/thread.html/rf58e1bee31d66665437dde9acd9abed53f84830...
https://lists.apache.org/thread.html/rfb45527bad7220ada9e30957762e1da254ce405...
https://lists.apache.org/thread.html/rfb45527bad7220ada9e30957762e1da254ce405...
https://lists.apache.org/thread.html/rfe52b7cbba4dcba521e13130e5d28d5818b78d7...
https://security.netapp.com/advisory/ntap-20231227-0010/
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/security-alerts/cpuoct2021.html
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
https://www.slf4j.org/news.html
受影响软件情况
# 类型 厂商 产品 版本 影响面
1
运行在以下环境
应用 oracle utilities_framework 4.2.0.2.0 -
运行在以下环境
应用 oracle utilities_framework 4.2.0.3.0 -
运行在以下环境
应用 oracle utilities_framework 4.3.0.2.0 -
运行在以下环境
应用 oracle utilities_framework 4.3.0.3.0 -
运行在以下环境
应用 oracle utilities_framework 4.3.0.4.0 -
运行在以下环境
应用 oracle utilities_framework 4.3.0.5.0 -
运行在以下环境
应用 oracle utilities_framework 4.3.0.6.0 -
运行在以下环境
应用 oracle utilities_framework 4.4.0.0.0 -
运行在以下环境
应用 redhat jboss_enterprise_application_platform 6.0.0 -
运行在以下环境
应用 redhat jboss_enterprise_application_platform 6.4.0 -
运行在以下环境
应用 redhat jboss_enterprise_application_platform 7.1 -
运行在以下环境
应用 slf4j slf4j-ext * Up to
(including)
1.7.25
运行在以下环境
应用 slf4j slf4j-ext 1.8.0 -
运行在以下环境
系统 amazon_2 slf4j * Up to
(excluding)
1.7.4-4.amzn2
运行在以下环境
系统 centos_7 slf4j * Up to
(excluding)
1.7.4-4.el7_4
运行在以下环境
系统 debian_10 libslf4j-java * Up to
(excluding)
1.7.25-3
运行在以下环境
系统 debian_11 libslf4j-java * Up to
(excluding)
1.7.25-3
运行在以下环境
系统 debian_12 libslf4j-java * Up to
(excluding)
1.7.25-3
运行在以下环境
系统 fedora_26 sl * Up to
(excluding)
1.7.22-5.fc26
运行在以下环境
系统 fedora_27 sl * Up to
(excluding)
1.7.25-4.fc27
运行在以下环境
系统 fedora_28 sl * Up to
(excluding)
1.7.25-4.fc28
运行在以下环境
系统 opensuse_Leap_15.0 slf4j * Up to
(excluding)
1.7.12-lp150.4.3.1
运行在以下环境
系统 oracle_7 slf4j * Up to
(excluding)
1.7.4-4.el7_4
运行在以下环境
系统 redhat_7 slf4j * Up to
(excluding)
1.7.4-4.el7_4
阿里云评分
3.1
  • 攻击路径
    远程
  • 攻击复杂度
    复杂
  • 权限要求
    无需权限
  • 影响范围
    有限影响
  • EXP成熟度
    未验证
  • 补丁情况
    官方补丁
  • 数据保密性
    无影响
  • 数据完整性
    无影响
  • 服务器危害
    无影响
  • 全网数量
    100
CWE-ID 漏洞类型
CWE-502 可信数据的反序列化
NVD-CWE-noinfo
阿里云安全产品覆盖情况