Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2023-6378: Logback classic and core can be crashed by crafted data
CVE-2023-6378 · published 2 years ago
Summary
The Logback logging library version 1.4.11 includes a component that can be triggered to stop working when it receives specially crafted information. This could cause your applications that use Logback to become unresponsive, affecting availability. Update Logback to a newer version or apply the vendor's patch to stop the issue.
What to do
- Update qos ch.qos.logback:logback-classic to version 1.4.12.
- Update qos ch.qos.logback:logback-core to version 1.4.12.
- Update qos ch.qos.logback:logback-classic to version 1.3.12.
- Update qos ch.qos.logback:logback-core to version 1.3.12.
- Update qos ch.qos.logback:logback-core to version 1.2.13.
- Update qos ch.qos.logback:logback-classic to version 1.2.13.
- Update root io.root.ch.qos.logback:logback-classic to version 1.4.11-root.io.5.
- Update root io.root.ch.qos.logback:logback-core to version 1.0.12-root.io.1.
- Update root io.root.ch.qos.logback:logback-classic to version 1.0.12-root.io.1.
- Update qos ch.qos.logback:logback-core to version 1.0.12-aikido.1.
- Update qos ch.qos.logback:logback-classic to version 1.0.12-aikido.1.
- Update root io.root.ch.qos.logback:logback-core to version 1.2.13-root.io.1.
- Update qos ch.qos.logback:logback-core to version 1.2.13-aikido.1.
- Update root io.root.ch.qos.logback:logback-core to version 1.2.13-root.io.2.
- Update root io.root.ch.qos.logback:logback-core to version 1.4.11-root.io.5.
- Update root io.root.ch.qos.logback:logback-core to version 1.1.3-root.io.2.
- Update qos ch.qos.logback:logback-core to version 1.2.13-aikido.2.
- Update root io.root.ch.qos.logback:logback-classic to version 1.1.3-root.io.2.
- Update debian logback to version 1:1.2.11-5.
- Update ch.qos.logback:logback-core to version 1.2.13-aikido.2.
- Update ch.qos.logback:logback-classic to version 1.0.12-aikido.1.
- Update io.root.ch.qos.logback:logback-classic to version 1.0.12-root.io.1.
- Update io.root.ch.qos.logback:logback-core to version 1.2.13-root.io.2.
- Update ch.qos.logback:logback-classic to version 1.2.11-aikido.1.
- Update io.root.ch.qos.logback:logback-classic to version 1.2.11-root.io.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | qos | ch.qos.logback:logback-classic |
>= 1.4.0, < 1.4.12 >= 1.3.0, < 1.3.12 < 1.2.13 Fix: upgrade to 1.4.12
|
| maven | qos | ch.qos.logback:logback-core |
>= 1.4.0, < 1.4.12 >= 1.3.0, < 1.3.12 < 1.2.13 Fix: upgrade to 1.4.12
|
| – | qos | logback |
>= 1.2.0, < 1.2.13 >= 1.3.0, < 1.3.12 >= 1.4.0, < 1.4.12 cpe:2.3:a:qos:logback:*:*:*:*:*:*:*:* |
| Root:Maven | root | io.root.ch.qos.logback:logback-classic |
< 1.4.11-root.io.5 < 1.0.12-root.io.1 < 1.1.3-root.io.2 Fix: upgrade to 1.4.11-root.io.5
|
| Root:Maven | root | io.root.ch.qos.logback:logback-core |
< 1.0.12-root.io.1 < 1.2.13-root.io.1 < 1.2.13-root.io.2 < 1.4.11-root.io.5 < 1.1.3-root.io.2 Fix: upgrade to 1.0.12-root.io.1
|
| Root:Maven | qos | ch.qos.logback:logback-core |
< 1.0.12-aikido.1 < 1.2.13-aikido.1 < 1.2.13-aikido.2 Fix: upgrade to 1.0.12-aikido.1
|
| Root:Maven | qos | ch.qos.logback:logback-classic |
< 1.0.12-aikido.1 Fix: upgrade to 1.0.12-aikido.1
|
| Debian:12 | debian | logback | All versions |
| Debian:13 | debian | logback |
< 1:1.2.11-5 Fix: upgrade to 1:1.2.11-5
|
| Root:Maven | – | ch.qos.logback:logback-core |
< 1.2.13-aikido.2 Fix: upgrade to 1.2.13-aikido.2
|
| Root:Maven | – | ch.qos.logback:logback-classic |
< 1.0.12-aikido.1 < 1.2.11-aikido.1 Fix: upgrade to 1.0.12-aikido.1
|
| Root:Maven | – | io.root.ch.qos.logback:logback-classic |
< 1.0.12-root.io.1 < 1.2.11-root.io.1 Fix: upgrade to 1.0.12-root.io.1
|
| Root:Maven | – | io.root.ch.qos.logback:logback-core |
< 1.2.13-root.io.2 Fix: upgrade to 1.2.13-root.io.2
|
Original advisory text
Logback "receiver" DOS vulnerability
A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.
References
- https://github.com/qos-ch/logback/commit/9c782b45be4abdafb7e17481e24e7354c2acd1e...
- https://github.com/qos-ch/logback/commit/b8eac23a9de9e05fb6d51160b3f46acd91af973...
- https://logback.qos.ch/manual/receivers.html
- https://github.com/qos-ch/logback/issues/745#issuecomment-1836227158
- https://github.com/qos-ch/logback/commit/bb095154be011267b64e37a1d401546e7cc2b7c...
- https://logback.qos.ch/news.html#1.2.13
- https://security.netapp.com/advisory/ntap-20241129-0012
- https://github.com/advisories/GHSA-vmq6-5m68-f53m
- https://security-tracker.debian.org/tracker/CVE-2023-6378 Vendor Advisory
- https://logback.qos.ch/news.html#1.3.12 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6378.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-6378 Vendor Advisory
- https://security.netapp.com/advisory/ntap-20241129-0012/ Vendor Advisory
- https://github.com/qos-ch/logback Product
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.5
High
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published29 Nov 2023
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-vmq6-5m68-f53m · GHSA
CVE-2023-6378 · NVD
DEBIAN-CVE-2023-6378 · OSV
CVE-2023-6378 · OSV
Track software like this
Free during beta