Red Hat Security AdvisoryRHSA-2018:0582
rh-maven35-slf4j security update
Released 2018-03-26 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-maven35-jcl-over-slf4j-1.7.25-1.3.el7, rh-maven35-jul-to-slf4j-1.7.25-1.3.el7, rh-maven35-log4j-over-slf4j-1.7.25-1.3.el7 +8
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-maven35-jcl-over-slf4j-1.7.25-1.3.el7, rh-maven35-jul-to-slf4j-1.7.25-1.3.el7, rh-maven35-log4j-over-slf4j-1.7.25-1.3.el7 +8
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-maven35-jcl-over-slf4j-1.7.25-1.3.el7, rh-maven35-jul-to-slf4j-1.7.25-1.3.el7, rh-maven35-log4j-over-slf4j-1.7.25-1.3.el7 +8
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-maven35-jcl-over-slf4j-1.7.25-1.3.el7, rh-maven35-jul-to-slf4j-1.7.25-1.3.el7, rh-maven35-log4j-over-slf4j-1.7.25-1.3.el7 +8
Fixes 1 record
Priority MEDIUM 58
org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.14703 · Published 2018-03-20 · Partial fix · 1.7.26, 1.8.0-beta4 CWE-284
