Bug 13805

Summary: [CVE 21] slf4j 1.7.25 CVEs found
Product: [ROSA-based products] ROSA Fresh Reporter: Yury <y.tumanov>
Component: System (kernel, glibc, systemd, bash, PAM...)Assignee: ROSA Linux Bugs <bugs>
Status: VERIFIED FIXED QA Contact: ROSA Linux Bugs <bugs>
Severity: blocker    
Priority: Highest CC: a.proklov, e.kosachev, s.matveev, v.potapov, y.tumanov
Version: AllFlags: v.potapov: qa_verified+
y.tumanov: secteam_verified+
a.proklov: published+
Target Milestone: 2021.1 Fresh R12   
Hardware: All   
OS: Linux   
URL: CVE-2018-8088,
Whiteboard:
Platform: 2021.1 ROSA Vulnerability identifier:
RPM Package: ISO-related:
Bad POT generating: Upstream:

Description Yury 2023-10-18 20:06:00 MSK 
Please patch CVEs for package slf4j version 1.7.25
  
INFO (CVEs are): slf4j 1.7.25
 cves found
CVE-2018-8088
Desc: org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.
Link: https://nvd.nist.gov/vuln/detail/CVE-2018-8088
Severity: CRITICAL
Comment 1 Vladimir Potapov 2023-10-20 11:42:34 MSK 
*** Bug 13937 has been marked as a duplicate of this bug. ***
Comment 2 Aleksandr Proklov 2023-10-22 03:09:11 MSK 
It has been solved in 1.7.26 and 1.8.0-beta4.
Comment 3 Svyatoslav Matveev 2023-10-22 18:39:33 MSK 
********** QA ADVISORY **********

Закрыто обновлением.
Опасно обновлять ява пакеты,можно разломать стэк.

***  slf4j
**   upd: 1.7.25 .. 1.7.26

https://abf.io/build_lists/4760190
https://abf.io/build_lists/4760191
Comment 4 Yury 2023-10-27 17:55:40 MSK 
secteam_verified
Comment 5 Vladimir Potapov 2023-11-03 10:48:28 MSK 
*****************************************
The update sent to testings
Comment 6 Vladimir Potapov 2023-11-08 11:34:53 MSK 
slf4j-1.7.26-1
https://abf.io/build_lists/4760190
https://abf.io/build_lists/4760191
********************** Advisory ***********************
CVE-2018-8088 fix
*******************************************************
QA Verified