CVE-2018-8088 Improper Access Control in SLF4J
Remote attackers can bypass access restrictions in the SLF4J logging library via crafted data, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-8088?
CVE-2018-8088 is a critical unsafe deserialization vulnerability in Redhat Enterprise Linux Desktop, published on 20 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.
Which versions are affected by CVE-2018-8088?
4 open source packages ship an affected version, including org.slf4j:slf4j-ext. It affects 13 products.
| Package | Affected | Fixed in |
|---|---|---|
org.slf4j:slf4j-ext Maven | All versions | 1.7.26 |
org.slf4j:slf4j-ext Maven | All versions | 1.7.26 |
org.slf4j:slf4j-ext Maven | From 1.8.0-alpha0 | 1.8.0-beta4 |
org.slf4j:slf4j-ext Maven | From 1.8.0-alpha0 | 1.8.0-beta4 |
Linux distribution packages (36)
slf4j Red Hat:enterprise_linux:7::client | All versions | 0:1.7.4-4.el7_4 |
slf4j-javadoc Red Hat:enterprise_linux:7::client | All versions | 0:1.7.4-4.el7_4 |
slf4j-manual Red Hat:enterprise_linux:7::client | All versions | 0:1.7.4-4.el7_4 |
slf4j Red Hat:enterprise_linux:7::computenode | All versions | 0:1.7.4-4.el7_4 |
slf4j-javadoc Red Hat:enterprise_linux:7::computenode | All versions | 0:1.7.4-4.el7_4 |
slf4j-manual Red Hat:enterprise_linux:7::computenode | All versions | 0:1.7.4-4.el7_4 |
slf4j Red Hat:enterprise_linux:7::server | All versions | 0:1.7.4-4.el7_4 |
slf4j-javadoc Red Hat:enterprise_linux:7::server | All versions | 0:1.7.4-4.el7_4 |
slf4j-manual Red Hat:enterprise_linux:7::server | All versions | 0:1.7.4-4.el7_4 |
slf4j Red Hat:enterprise_linux:7::workstation | All versions | 0:1.7.4-4.el7_4 |
slf4j-javadoc Red Hat:enterprise_linux:7::workstation | All versions | 0:1.7.4-4.el7_4 |
slf4j-manual Red Hat:enterprise_linux:7::workstation | All versions | 0:1.7.4-4.el7_4 |
slf4j Red Hat:jboss_enterprise_application_platform:6::el5 | All versions | 0:1.7.2-14.redhat_4.1.ep6.el5 |
slf4j-eap6 Red Hat:jboss_enterprise_application_platform:6::el5 | All versions | 0:1.7.2-14.redhat_4.1.ep6.el5 |
slf4j-eap6 Red Hat:jboss_enterprise_application_platform:6::el6 | All versions | 0:1.7.2-14.redhat_4.1.ep6.el6 |
slf4j-eap6 Red Hat:jboss_enterprise_application_platform:6::el7 | All versions | 0:1.7.2-14.redhat_4.1.ep6.el7 |
eap7-jcl-over-slf4j Red Hat:jboss_enterprise_application_platform:7.1::el7 | All versions | 0:1.7.22-3.redhat_2.1.ep7.el7 |
eap7-slf4j Red Hat:jboss_enterprise_application_platform:7.1::el7 | All versions | 0:1.7.22-3.redhat_2.1.ep7.el7 |
eap7-slf4j-api Red Hat:jboss_enterprise_application_platform:7.1::el7 | All versions | 0:1.7.22-3.redhat_2.1.ep7.el7 |
eap7-slf4j-ext Red Hat:jboss_enterprise_application_platform:7.1::el7 | All versions | 0:1.7.22-3.redhat_2.1.ep7.el7 |
eap7-jcl-over-slf4j Red Hat:jboss_enterprise_application_platform:7::el6 | All versions | 0:1.7.22-3.redhat_2.1.ep7.el6 |
eap7-slf4j Red Hat:jboss_enterprise_application_platform:7::el6 | All versions | 0:1.7.22-3.redhat_2.1.ep7.el6 |
eap7-slf4j-api Red Hat:jboss_enterprise_application_platform:7::el6 | All versions | 0:1.7.22-3.redhat_2.1.ep7.el6 |
eap7-slf4j-ext Red Hat:jboss_enterprise_application_platform:7::el6 | All versions | 0:1.7.22-3.redhat_2.1.ep7.el6 |
rh-maven35-jcl-over-slf4j Red Hat:rhel_software_collections:3::el7 | All versions | 0:1.7.25-1.3.el7 |
rh-maven35-jul-to-slf4j Red Hat:rhel_software_collections:3::el7 | All versions | 0:1.7.25-1.3.el7 |
rh-maven35-log4j-over-slf4j Red Hat:rhel_software_collections:3::el7 | All versions | 0:1.7.25-1.3.el7 |
rh-maven35-slf4j Red Hat:rhel_software_collections:3::el7 | All versions | 0:1.7.25-1.3.el7 |
rh-maven35-slf4j-ext Red Hat:rhel_software_collections:3::el7 | All versions | 0:1.7.25-1.3.el7 |
rh-maven35-slf4j-javadoc Red Hat:rhel_software_collections:3::el7 | All versions | 0:1.7.25-1.3.el7 |
rh-maven35-slf4j-jcl Red Hat:rhel_software_collections:3::el7 | All versions | 0:1.7.25-1.3.el7 |
rh-maven35-slf4j-jdk14 Red Hat:rhel_software_collections:3::el7 | All versions | 0:1.7.25-1.3.el7 |
rh-maven35-slf4j-log4j12 Red Hat:rhel_software_collections:3::el7 | All versions | 0:1.7.25-1.3.el7 |
rh-maven35-slf4j-manual Red Hat:rhel_software_collections:3::el7 | All versions | 0:1.7.25-1.3.el7 |
rh-maven35-slf4j-sources Red Hat:rhel_software_collections:3::el7 | All versions | 0:1.7.25-1.3.el7 |
slf4j SUSE:HPE Helion OpenStack 8 | All versions | 1.7.12-3.3.1 |
Products include Oracle Goldengate Application Adapters, Oracle Goldengate Stream Analytics, Oracle Utilities Framework, Qos Slf4j, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Eus and 7 more.
How do I fix CVE-2018-8088?
Upgrade org.slf4j:slf4j-ext to a fixed version for your release line: 1.7.26 or 1.8.0-beta4.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2018-8088 being exploited?
There is no known exploitation of CVE-2018-8088 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2018-8088, GHSA-w77p-8cfg-2x43, RHSA-2018:0582, RHSA-2018:0592, RHSA-2018:0627, RHSA-2018:0628 and 2 more.