Executive Summary

This vulnerability is a deserialization of untrusted data issue in the QOS.CH Sarl logback logback-core module, specifically in the HardenedObjectInputStream component.

An attacker who can influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer can instantiate objects from certain classes in the java.lang and java.util packages that are not explicitly blocked.

Although the deserialization process is heavily restricted and no practical way to achieve remote code execution or significant privilege escalation has been identified, this vulnerability bypasses the intended security restrictions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to bypass security restrictions by instantiating certain objects during deserialization.

However, since the deserialization is heavily restricted and no practical remote code execution or significant privilege escalation has been identified, the impact is limited.

The overall risk is low, as reflected by the CVSS base score of 1.2.

Useful 0 Not Useful 0