https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 11:44:07 +0000 https://vulnerability.circl.lu/vuln/ghsa-p47f-322f-whfh <p><strong>Affected:</strong> Maven: ch.qos.logback:logback-core</p> <p>Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection albeit heavily restricted.</p> <p>More precisely, an attacker able to influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer can instantiate objects from classes in the java.lang and java.util packages that are not explicitly blocked.</p> <p>Although deserialization is heavily restricted by HardenedObjectInputStream and no practical way to achieve remote code execution or significant privilege escalation has been identified, this issue constitutes a bypass of the intended security restrictions.</p> <p>This issue affects logback: through 1.5.32 inclusive.</p> <p><strong>Affected:</strong> Maven: ch.qos.logback:logback-core</p> <p>Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection albeit heavily restricted.</p> <p>More precisely, an attacker able to influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer can instantiate objects from classes in the java.lang and java.util packages that are not explicitly blocked.</p> <p>Although deserialization is heavily restricted by HardenedObjectInputStream and no practical way to achieve remote code execution or significant privilege escalation has been identified, this issue constitutes a bypass of the intended security restrictions.</p> <p>This issue affects logback: through 1.5.32 inclusive.</p> https://vulnerability.circl.lu/vuln/ghsa-p47f-322f-whfh