CVE-2018-8088 — CRITICAL (9.8)

Q: How severe is CVE-2018-8088?

CVE-2018-8088 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Q: Is there a patch for CVE-2018-8088?

Check the references section above for vendor advisories and patch information. Affected products include: Qos Slf4J, Redhat Jboss Enterprise Application Platform, Redhat Enterprise Linux, Redhat Virtualization, Redhat Virtualization Host.

Vulnerability Description

org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Qos	Slf4J	< 1.7.26
Redhat	Jboss Enterprise Application Platform	7.1
Redhat	Enterprise Linux	6.0
Redhat	Virtualization	4.0
Redhat	Virtualization Host	4.0
Redhat	Enterprise Linux Server	7.0
Redhat	Enterprise Linux Desktop	7.0
Redhat	Enterprise Linux Eus	7.4
Redhat	Enterprise Linux Server Aus	7.4
Redhat	Enterprise Linux Server Tus	7.4
Redhat	Enterprise Linux Workstation	7.0
Oracle	Goldengate Application Adapters	12.3.2.1.0
Oracle	Goldengate Stream Analytics	< 19.1.0.0.1
Oracle	Utilities Framework	4.2.0.2.0

References

http://www.securityfocus.com/bid/103737Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040627Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2018:0582Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0592Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0627Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0628Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0629Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0630Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1247Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1248Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1249Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1251Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1323Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1447Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1448Third Party Advisory

FAQ

What is CVE-2018-8088?

CVE-2018-8088 is a vulnerability with a CVSS score of 9.8 (CRITICAL). org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in...

How severe is CVE-2018-8088?

CVE-2018-8088 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2018-8088?

Check the references section above for vendor advisories and patch information. Affected products include: Qos Slf4J, Redhat Jboss Enterprise Application Platform, Redhat Enterprise Linux, Redhat Virtualization, Redhat Virtualization Host.