title: Logback "receiver" DOS vulnerability CVE-2023-6378 incomplete fix
description: A serialization vulnerability in logback receiver component part of
logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service
attack by sending poisoned data.
problem types: Denial-of-service using poisoned data
affected:
{
defaultStatus: unaffected
modules: logback receiver
platforms: [Windows, Linux, MacOS]
product: logback
repo: https://github.com/qos-ch/logback
vendor: QOS.CH Sarl
versions:
status: unaffected, version: 1.4.14
status: unaffected, version: 1.3.14
status: unaffected, version: 1.2.13
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Only environments where logback receiver component is deployed may be vulnerable.
In case a logback receiver is deployed, restricting connections to
trustworthy clients or  upgrading to logback version 1.4.14, 1.3.14, 1.2.13 or later will remedy the vulnerability.
If you do not need to deploy logback-receiver, then please verify that you do not have any <receiver></receiver> entries in your configuration files.
workarounds: Logback versions 1.2.13 and later, 1.3.14
and later  or 1.4.14
and later
provides fixes. However, please note that these fixes are only effective when deployed under Java 9 or later.