Read the docs
TI-2018-05845 Aliases CVE-2018-8088GHSA-w77p-8cfg-2x43

org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows…

Priority MEDIUM 58CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 32 fixed, 11 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-284.

Summary

org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.

Why it matters now

EPSS 0.14703 96th percentileScored 2026-11-07
Fix Partial org.slf4j:slf4j-ext (Maven): 1.7.26, 1.8.0-beta4Red Hat: 26 advisoriesRed Hat: 32 fixed, 11 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.slf4j:slf4j-ext (Maven)before 1.7.261.7.26Patch availableGHSA-w77p-8cfg-2x43
—org.slf4j:slf4j-ext (Maven)1.8.0-alpha0 to before 1.8.0-beta41.8.0-beta4Patch availableGHSA-w77p-8cfg-2x43
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.slf4j:slf4j-ext (Maven) Vendor— Affected before 1.7.26 Fixed in 1.7.26 Patch available GHSA-w77p-8cfg-2x43
  • org.slf4j:slf4j-ext (Maven) Vendor— Affected 1.8.0-alpha0 to before 1.8.0-beta4 Fixed in 1.8.0-beta4 Patch available GHSA-w77p-8cfg-2x43

CPE configurations NVD · 37

CPEVersionsRoleVendor
cpe:2.3:a:qos:slf4j:*:*:*:*:*:*:*:*before 1.7.26VulnerableQos
cpe:2.3:a:qos:slf4j:1.8.0:alpha1:*:*:*:*:*:*1.8.0 alpha1VulnerableQos
cpe:2.3:a:qos:slf4j:1.8.0:alpha2:*:*:*:*:*:*1.8.0 alpha2VulnerableQos
cpe:2.3:a:qos:slf4j:1.8.0:beta1:*:*:*:*:*:*1.8.0 beta1VulnerableQos
cpe:2.3:a:qos:slf4j:1.8.0:beta2:*:*:*:*:*:*1.8.0 beta2VulnerableQos
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1:*:*:*:*:*:*:*7.1VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:*6.4.0VulnerableRed Hat
  • cpe:2.3:a:qos:slf4j:*:*:*:*:*:*:*:* Versions before 1.7.26 Vulnerable ·Qos
  • cpe:2.3:a:qos:slf4j:1.8.0:alpha1:*:*:*:*:*:* Versions 1.8.0 alpha1 Vulnerable ·Qos
  • cpe:2.3:a:qos:slf4j:1.8.0:alpha2:*:*:*:*:*:* Versions 1.8.0 alpha2 Vulnerable ·Qos
  • cpe:2.3:a:qos:slf4j:1.8.0:beta1:*:*:*:*:*:* Versions 1.8.0 beta1 Vulnerable ·Qos
  • cpe:2.3:a:qos:slf4j:1.8.0:beta2:*:*:*:*:*:* Versions 1.8.0 beta2 Vulnerable ·Qos
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:* Versions 6.4.0 Vulnerable ·Red Hat
Show 27 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*5.0Running onRed Hat
cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*7.5VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*7.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*7.7VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*7.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*7.7VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*7.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*7.7VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:oracle:goldengate_application_adapters:12.3.2.1.0:*:*:*:*:*:*:*12.3.2.1.0VulnerableOracle
cpe:2.3:a:oracle:goldengate_stream_analytics:*:*:*:*:*:*:*:*before 19.1.0.0.1VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:*4.2.0.2.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:*4.2.0.3.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.3.0.2.0:*:*:*:*:*:*:*4.3.0.2.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.3.0.3.0:*:*:*:*:*:*:*4.3.0.3.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.3.0.4.0:*:*:*:*:*:*:*4.3.0.4.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.3.0.5.0:*:*:*:*:*:*:*4.3.0.5.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.3.0.6.0:*:*:*:*:*:*:*4.3.0.6.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:*4.4.0.0.0VulnerableOracle
  • cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* Versions 5.0 Running on ·Red Hat
  • cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:* Versions 7.5 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:oracle:goldengate_application_adapters:12.3.2.1.0:*:*:*:*:*:*:* Versions 12.3.2.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:goldengate_stream_analytics:*:*:*:*:*:*:*:* Versions before 19.1.0.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:* Versions 4.2.0.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:* Versions 4.2.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.3.0.2.0:*:*:*:*:*:*:* Versions 4.3.0.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.3.0.3.0:*:*:*:*:*:*:* Versions 4.3.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.3.0.4.0:*:*:*:*:*:*:* Versions 4.3.0.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.3.0.5.0:*:*:*:*:*:*:* Versions 4.3.0.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.3.0.6.0:*:*:*:*:*:*:* Versions 4.3.0.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:* Versions 4.4.0.0.0 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-w77p-8cfg-2x43 org.slf4j:slf4j-ext (Maven) Fixed in 1.7.26 Advisory →
  • Fix · GHSA-w77p-8cfg-2x43 org.slf4j:slf4j-ext (Maven) Fixed in 1.8.0-beta4 Advisory →

Red Hat 26 advisories

  • RHSA-2020:2561 Released 2020-06-15 · Red Hat rating Critical
    EAP Continuous Delivery Technical Preview Release 12 security update
    • Red Hat JBoss Enterprise Application Platform Continuous Delivery
  • RHSA-2019:3140 Released 2019-10-17 · Red Hat rating Important
    Red Hat JBoss Data Virtualization 6.4.8 security update
    • Red Hat JBoss Data Virtualization 6.4.8
  • RHSA-2019:2413 Released 2019-08-08 · Red Hat rating Important
    Red Hat Fuse 7.4.0 security update
    • Red Hat Fuse 7.4.0
Show 23 more Red Hat advisories
  • RHSA-2018:2930 Released 2018-10-16 · Red Hat rating Important
    Red Hat JBoss Operations Network 3.3.11 security and bug fix update
    • Red Hat JBoss Operations Network 3.3
  • RHSA-2018:2669 Released 2018-09-11 · Red Hat rating Important
    Fuse 7.1 security update
    • Red Hat Fuse 7
  • RHSA-2018:2420 Released 2018-08-15 · Red Hat rating Important
    Red Hat JBoss BRMS 6.4.11 security update
    • Red Hat JBoss BRMS 6.4
  • RHSA-2018:2419 Released 2018-08-15 · Red Hat rating Important
    Red Hat JBoss BPM Suite 6.4.11 security update
    • Red Hat JBoss BPMS 6.4
  • RHSA-2018:2143 Released 2018-07-05 · Red Hat rating Important
    Red Hat Decision Manager 7.0.1 bug fix and security update
    • Red Hat JBoss BRMS 7.0
  • RHSA-2018:1575 Released 2018-05-16 · Red Hat rating Important
    Red Hat JBoss Data Grid 7.2 security update
    • Red Hat Data Grid
  • RHSA-2018:1525 Released 2018-05-15 · Red Hat rating Important
    rhvm-appliance security and enhancement update
    • Red Hat Virtualization 4 Hypervisor for RHEL 7 rhvm-appliance-2:4.2-20180504.0.el7
    • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts rhvm-appliance-2:4.2-20180504.0.el7
  • RHSA-2018:1451 Released 2018-05-14 · Red Hat rating Important
    eap6-jboss-ec2-eap security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server jboss-ec2-eap-7.5.20-1.Final_redhat_1.ep6.el6, jboss-ec2-eap-samples-7.5.20-1.Final_redhat_1.ep6.el6
  • RHSA-2018:1449 Released 2018-05-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.20 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server codehaus-jackson-1.9.9-12.redhat_6.1.ep6.el6, codehaus-jackson-core-asl-1.9.9-12.redhat_6.1.ep6.el6, codehaus-jackson-jaxrs-1.9.9-12.redhat_6.1.ep6.el6 +47
  • RHSA-2018:1450 Released 2018-05-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.20 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server codehaus-jackson-1.9.9-12.redhat_6.1.ep6.el5, codehaus-jackson-core-asl-1.9.9-12.redhat_6.1.ep6.el5, codehaus-jackson-jaxrs-1.9.9-12.redhat_6.1.ep6.el5 +47
  • RHSA-2018:1448 Released 2018-05-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.20 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server codehaus-jackson-1.9.9-12.redhat_6.1.ep6.el7, codehaus-jackson-core-asl-1.9.9-12.redhat_6.1.ep6.el7, codehaus-jackson-jaxrs-1.9.9-12.redhat_6.1.ep6.el7 +47
  • RHSA-2018:1447 Released 2018-05-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.20 security update
    • Red Hat JBoss Enterprise Application Platform 6.4
  • RHSA-2018:1323 Released 2018-05-04 · Red Hat rating Important
    Red Hat Single Sign-On 7.2.2 security update
    • Red Hat Single Sign-On 7.2.2 zip
  • RHSA-2018:1251 Released 2018-04-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.2 security update
    • Red Hat JBoss EAP 7.1
  • RHSA-2018:1249 Released 2018-04-25 · Red Hat rating Important
    jboss-ec2-eap package for EAP 7.1.2
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-jboss-ec2-eap-7.1.2-1.GA_redhat_1.ep7.el6, eap7-jboss-ec2-eap-samples-7.1.2-1.GA_redhat_1.ep7.el6
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-jboss-ec2-eap-7.1.2-1.GA_redhat_1.ep7.el7, eap7-jboss-ec2-eap-samples-7.1.2-1.GA_redhat_1.ep7.el7
  • RHSA-2018:1247 Released 2018-04-25 · Red Hat rating Important
    JBoss Enterprise Application Platform 7.1.2 for RHEL 7
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-activemq-artemis-1.5.5.010-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.010-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.010-1.redhat_1.1.ep7.el7 +47
  • RHSA-2018:1248 Released 2018-04-25 · Red Hat rating Important
    JBoss Enterprise Application Platform 7.1.2 on RHEL 6
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-activemq-artemis-1.5.5.010-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.5.5.010-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.5.5.010-1.redhat_1.1.ep7.el6 +47
  • RHSA-2018:0627 Released 2018-04-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server slf4j-1.7.2-14.redhat_4.1.ep6.el5, slf4j-eap6-1.7.2-14.redhat_4.1.ep6.el5
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server slf4j-eap6-1.7.2-14.redhat_4.1.ep6.el6
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server slf4j-eap6-1.7.2-14.redhat_4.1.ep6.el7
  • RHSA-2018:0628 Released 2018-04-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-jcl-over-slf4j-1.7.22-3.redhat_2.1.ep7.el6, eap7-slf4j-1.7.22-3.redhat_2.1.ep7.el6, eap7-slf4j-api-1.7.22-3.redhat_2.1.ep7.el6 +1
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-jcl-over-slf4j-1.7.22-3.redhat_2.1.ep7.el7, eap7-slf4j-1.7.22-3.redhat_2.1.ep7.el7, eap7-slf4j-api-1.7.22-3.redhat_2.1.ep7.el7 +1
  • RHSA-2018:0630 Released 2018-04-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4 security update
    • Red Hat JBoss Enterprise Application Platform 6.4
  • RHSA-2018:0629 Released 2018-04-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1 security update
    • Red Hat JBoss EAP 7.1
  • RHSA-2018:0592 Released 2018-03-26 · Red Hat rating Important
    slf4j security update
    • Red Hat Enterprise Linux Client Optional (v. 7) slf4j-1.7.4-4.el7_4, slf4j-javadoc-1.7.4-4.el7_4, slf4j-manual-1.7.4-4.el7_4
    • Red Hat Enterprise Linux ComputeNode (v. 7) slf4j-1.7.4-4.el7_4
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) slf4j-javadoc-1.7.4-4.el7_4, slf4j-manual-1.7.4-4.el7_4
    • Red Hat Enterprise Linux Server (v. 7) slf4j-1.7.4-4.el7_4
    • Red Hat Enterprise Linux Server Optional (v. 7) slf4j-javadoc-1.7.4-4.el7_4, slf4j-manual-1.7.4-4.el7_4
    • Red Hat Enterprise Linux Workstation (v. 7) slf4j-1.7.4-4.el7_4
    • Red Hat Enterprise Linux Workstation Optional (v. 7) slf4j-javadoc-1.7.4-4.el7_4, slf4j-manual-1.7.4-4.el7_4
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) slf4j-1.7.4-4.el7_4
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) slf4j-javadoc-1.7.4-4.el7_4, slf4j-manual-1.7.4-4.el7_4
  • RHSA-2018:0582 Released 2018-03-26 · Red Hat rating Important
    rh-maven35-slf4j security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-maven35-jcl-over-slf4j-1.7.25-1.3.el7, rh-maven35-jul-to-slf4j-1.7.25-1.3.el7, rh-maven35-log4j-over-slf4j-1.7.25-1.3.el7 +8
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-maven35-jcl-over-slf4j-1.7.25-1.3.el7, rh-maven35-jul-to-slf4j-1.7.25-1.3.el7, rh-maven35-log4j-over-slf4j-1.7.25-1.3.el7 +8
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-maven35-jcl-over-slf4j-1.7.25-1.3.el7, rh-maven35-jul-to-slf4j-1.7.25-1.3.el7, rh-maven35-log4j-over-slf4j-1.7.25-1.3.el7 +8
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-maven35-jcl-over-slf4j-1.7.25-1.3.el7, rh-maven35-jul-to-slf4j-1.7.25-1.3.el7, rh-maven35-log4j-over-slf4j-1.7.25-1.3.el7 +8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
JBoss Developer Studio 11AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix yet
Red Hat JBoss A-MQ 6Affected—
Red Hat JBoss Data Grid 7AffectedNo fix yet
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6Affected—
Red Hat JBoss Fuse Integration Service 2AffectedNo fix yet
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat JBoss SOA Platform 5AffectedNo fix planned: Will not fix
Red Hat Subscription Asset ManagerAffectedNo fix planned: Will not fix
Red Hat Data GridFixed RHSA-2018:1575
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2018:0592
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2018:0592
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2018:0592
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2018:0592
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2018:0592
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2018:0592
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2018:0592
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)Fixed RHSA-2018:0592
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)Fixed RHSA-2018:0592
Red Hat Fuse 7Fixed RHSA-2018:2669
Red Hat Fuse 7.4.0Fixed RHSA-2019:2413
Red Hat JBoss BPMS 6.4Fixed RHSA-2018:2419
Red Hat JBoss BRMS 6.4Fixed RHSA-2018:2420
Red Hat JBoss BRMS 7.0Fixed RHSA-2018:2143
Red Hat JBoss Data Virtualization 6.4.8Fixed RHSA-2019:3140
Red Hat JBoss EAP 7.1Fixed RHSA-2018:0629
Red Hat JBoss Enterprise Application Platform 6.4Fixed RHSA-2018:0630
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 ServerFixed RHSA-2018:0627, RHSA-2018:1450
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 ServerFixed RHSA-2018:0627, RHSA-2018:1449, RHSA-2018:1451
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 ServerFixed RHSA-2018:0627, RHSA-2018:1448
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 ServerFixed RHSA-2018:0628, RHSA-2018:1248, RHSA-2018:1249
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 ServerFixed RHSA-2018:0628, RHSA-2018:1247, RHSA-2018:1249
Red Hat JBoss Enterprise Application Platform Continuous DeliveryFixed RHSA-2020:2561
Red Hat JBoss Operations Network 3.3Fixed RHSA-2018:2930
Red Hat Single Sign-On 7.2.2 zipFixed RHSA-2018:1323
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2018:0582
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)Fixed RHSA-2018:0582
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)Fixed RHSA-2018:0582
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2018:0582
Red Hat Virtualization 4 Hypervisor for RHEL 7Fixed RHSA-2018:1525
Red Hat Virtualization 4 Management Agent for RHEL 7 HostsFixed RHSA-2018:1525
Not affected: 14 products
  • Red Hat Enterprise Linux 8
  • Red Hat JBoss BRMS 5
  • Red Hat JBoss Data Grid 6
  • Red Hat JBoss Portal 6
  • Red Hat JBoss Web Server 3
  • Red Hat OpenShift Application Runtimes
  • Red Hat OpenStack Platform 10 (Newton)
  • Red Hat OpenStack Platform 11 (Ocata)
  • Red Hat OpenStack Platform 12 (Pike)
  • Red Hat OpenStack Platform 13 (Queens)
  • Red Hat OpenStack Platform 8 (Liberty)
  • Red Hat OpenStack Platform 9 (Mitaka)
  • Red Hat Satellite 6
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-8088
  2. 2026-10-03 Alias added: GHSA-w77p-8cfg-2x43
  3. 2026-11-03 Fix available: Red Hat Fuse 7 · Red Hat

References

Patch 2

Advisory 30

Other 58

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences