PatchTheCVElogback vulnerabilities and fixes
Recent CVEs affecting logback, with upgrade or downgrade steps. 4 tracked.
logback has 4 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2023-12-04. Highest priority: CVE-2017-5929 (score 68/100).
- CVE-2023-6481 HIGH 7.1 DOWNGRADE A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12
- CVE-2023-6378 HIGH 7.1 UPGRADE A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker
- CVE-2021-42550 MEDIUM 6.6 UPGRADE DOWNGRADE In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations f
- CVE-2017-5929 CRITICAL 9.8 UPGRADE DOWNGRADE QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketRecei
FAQ
How do I fix logback vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is logback being exploited right now?
None of the tracked logback CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which logback CVE should I patch first?
CVE-2017-5929 currently ranks highest (68/100): QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketRecei.