JaninoEventEvaluator vulnerability
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · High · Low
- Fix status
- Partial Red Hat: 1 fixed, 14 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-917.
Summary
ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution. Malicious logback configuration files can allow the attacker to execute arbitrary code using the JaninoEventEvaluator extension. A successful attack requires the user to have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| QOS.CH Sarl | Logback-core | 0.1 – 1.3.14; 1.4.0 – 1.5.12 | 1.3.15, 1.5.13 | Patch available | CNA |
| — | ch.qos.logback:logback-core (Maven) | 1.4.0 to before 1.5.13 | 1.5.13 | Patch available | GHSA-pr98-23f8-jwxv |
| — | ch.qos.logback:logback-core (Maven) | before 1.3.15 | 1.3.15 | Patch available | GHSA-pr98-23f8-jwxv |
- Logback-core VendorQOS.CH Sarl Affected 0.1 – 1.3.14; 1.4.0 – 1.5.12 Fixed in 1.3.15, 1.5.13 Patch available CNA
- ch.qos.logback:logback-core (Maven) Vendor— Affected 1.4.0 to before 1.5.13 Fixed in 1.5.13 Patch available GHSA-pr98-23f8-jwxv
- ch.qos.logback:logback-core (Maven) Vendor— Affected before 1.3.15 Fixed in 1.3.15 Patch available GHSA-pr98-23f8-jwxv
Remediation
- Fix · CNA Logback-core (QOS.CH Sarl) Fixed in 1.3.15, 1.5.13
- Fix · GHSA-pr98-23f8-jwxv ch.qos.logback:logback-core (Maven) Fixed in 1.5.13 Advisory →
- Fix · GHSA-pr98-23f8-jwxv ch.qos.logback:logback-core (Maven) Fixed in 1.3.15 Advisory →
Red Hat 1 advisory
- RHSA-2025:1078 Released 2025-02-05 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.8.3 for Spring Boot security update.
- Red Hat build of Apache Camel 4.8.3 for Spring Boot
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| A-MQ Clients 2 | Affected | No fix yet |
| Logging Subsystem for Red Hat OpenShift | Affected | No fix yet |
| Red Hat AMQ Broker 7 | Affected | No fix yet |
| Red Hat AMQ Clients | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat JBoss Data Grid 7 | Affected | No fix yet |
| Red Hat Process Automation 7 | Affected | No fix yet: Fix deferred |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Debezium 2 | Affected | No fix planned: Will not fix |
| Red Hat build of OptaPlanner 8 | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka | Affected | No fix yet |
| Red Hat build of Apache Camel 4.8.3 for Spring Boot | Fixed | RHSA-2025:1078 |
Not affected: 5 products
- Red Hat Build of Keycloak
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat JBoss Web Server 6
Timeline
- 2026-10-02 Threatist record created from CVE-2024-12798
- 2026-10-03 Alias added: GHSA-pr98-23f8-jwxv
- 2026-10-16 Affected versions changed · Red Hat
References
More QOS.CH Sarl vulnerabilities
- TI-2026-11065 Incomplete protection against CVE-2025-11226 CVSS 4.0HIGH 7.0
- TI-2025-10282 Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino CVSS 4.0HIGH 7.0
- TI-2026-66127 Logback: Incomplete protection against CVE-2026-19880 CVSS 4.0MEDIUM 6.3
- TI-2026-16116 Incomplete protection against CVE-2025-11226 CVSS 4.0MEDIUM 6.3
- TI-2026-09059 Logback deserialization whitelist bypass for Proxy objects CVSS 4.0LOW 2.9
- TI-2026-08607 Logback deserialization whitelist bypass for java.lang and java.util CVSS 4.0LOW 2.9
Sources
- CVE-2024-12798 · CVE Program
- CVE-2024-12798 · NVD
- FIRST EPSS
- GHSA-pr98-23f8-jwxv · GitHub Advisory Database · CC BY 4.0
- CVE-2024-12798 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences