Vulnerability	Vulnerable Version
H Expression Injection ch.qos.logback:logback-core is a logback-core module. Affected versions of this package are vulnerable to Expression Injection in the Janino-evaluated `condition` attribute of `<if>` configuration elements, handled by `IfModelHandler`, whose denylist blocked only the literal `new` operator. A user who can modify the logback configuration can execute arbitrary code by writing an `<if>` condition that evades that denylist, either through references it did not cover such as `Runtime` or `springframework`, or through Unicode escape sequences like `\u` that reconstruct the blocked `new` operator. Exploitation requires write access to the logback configuration and the use of conditional `<if>` processing with Janino present on the classpath. How to fix Expression Injection? Upgrade `ch.qos.logback:logback-core` to version 1.5.36 or higher.	[0.9.20,1.5.36)

Expression Injection

ch.qos.logback:logback-core is a logback-core module.

Affected versions of this package are vulnerable to Expression Injection in the Janino-evaluated condition attribute of <if> configuration elements, handled by IfModelHandler, whose denylist blocked only the literal new operator. A user who can modify the logback configuration can execute arbitrary code by writing an <if> condition that evades that denylist, either through references it did not cover such as Runtime or springframework, or through Unicode escape sequences like \u that reconstruct the blocked new operator. Exploitation requires write access to the logback configuration and the use of conditional <if> processing with Janino present on the classpath.

How to fix Expression Injection?

Upgrade ch.qos.logback:logback-core to version 1.5.36 or higher.

[0.9.20,1.5.36)

Go back to all versions of this package