🔐 CVE-2023-6378: pkg:maven/ch.qos.logback/logback-core@1.2.10

[github-actions[bot]]

Summary

A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

CVE: CVE-2023-6378 CWE: CWE-502

References

• https://ossindex.sonatype.org/vulnerability/CVE-2023-6378?component-type=maven&component-name=ch.qos.logback%2Flogback-core&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
• http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-6378
• https://logback.qos.ch/news.html#1.3.12
• https://github.com/advisories/GHSA-vmq6-5m68-f53m

[ckunki]

Approved PR #292 (vulnerabilities)

[ckunki]

And approved PR #291 (tests with many files)