CoreCVE
Back

CRITICAL

slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution

Published Mar 20, 2018

Description

org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.

Affected products

Remediation

Red Hat statement

Subscription Asset Manager is now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. This issue did not affect the versions of Candlepin as shipped with Red Hat Satellite 6 as Candlepin uses slf4j-api and not the affected slf4j-ext (which is not on the Candlepin classpath). Red Hat Enterprise Virtualization Manager 4.1 is affected by this issue. Updated packages that address this issue are available through the Red Hat Enterprise Linux Server channels. Virtualization Manager hosts should be subscribed to these channels and obtain the updates via `yum update`.

Metrics

Weaknesses (2)

CWE-284

CWE-502

Deserialization of Untrusted Data

References (95)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Mar 20, 2018
Updated Aug 5, 2024
Reserved Mar 13, 2018
Link CVE-2018-8088
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2018-8088
Red Hat
Severity Important
Public date Feb 22, 2018
Links CVE-2018-8088 - Bugzilla
GHSA-W77P-8CFG-2X43