Homepage
About Snyk

Insufficient Hostname Verification Affecting ch.qos.logback:logback-core package, versions [,1.2.7)

Severity

 Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-CHQOSLOGBACK-1726923
  • published 1 Oct 2021
  • disclosed 29 Sep 2021
  • credit Andrei Komarov
Report a new vulnerability Found a mistake?

Introduced: 29 Sep 2021

CVE NOT AVAILABLE CWE-20 Open this link in a new tab

How to fix?

Upgrade ch.qos.logback:logback-core to version 1.2.7 or higher.

Overview

ch.qos.logback:logback-core is a logback-core module.

Affected versions of this package are vulnerable to Insufficient Hostname Verification. X.509 are not properly validated. By spoofing the TLS/SSL server via a certificate that appears valid, an attacker with the ability to intercept network traffic (e.g. MitM, DNS cache poisoning) can disclose and optionally manipulate transmitted data.

CVSS Scores

version 3.1
Expand this section

Snyk

Recommended
4.8 medium
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    High
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    Low
  • Integrity (I)
    Low
  • Availability (A)
    None