title: Logback "receiver" DOS vulnerability
description: A serialization vulnerability in logback receiver component part of
logback version 1.4.11 allows an attacker to mount a Denial-Of-Service
attack by sending poisoned data.
problem types: Denial-of-service using poisoned data
affected:
{
defaultStatus: unaffected
modules: logback receiver
platforms: [Windows, Linux, MacOS]
product: logback
repo: https://github.com/qos-ch/logback
vendor: QOS.CH Sarl
versions:
status: unaffected, version: 1.4.12
status: unaffected, version: 1.3.12
status: unaffected, version: 1.2.13
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Only environments where logback receiver component is deployed may be vulnerable.
In case a logback receiver is deployed, restricting connections to
trustworthy clients or  upgrading to logback version 1.4.12 or later will remedy the vulnerability.
workarounds: Only environments where logback receiver is deployed are vulnerable.