org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access…

Description

org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.

Scores

EPSS (exploitation in 30 days)

14.7% · top 3.3% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

• n/a

Affected products

• n/a

  • affected n/a

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenorg.slf4j:slf4j-extGHSA-w77p-8cfg-2x43 (opens in a new tab)

References (63)

• RHSA-2018:1448 (opens in a new tab)vendor-advisoryx_transferred
• 1040627 (opens in a new tab)vdb-entryx_transferred
• RHSA-2018:1449 (opens in a new tab)vendor-advisoryx_transferred
• https://jira.qos.ch/browse/SLF4J-431 (opens in a new tab)x_transferred
• RHSA-2018:1248 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2018:1251 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2018:2143 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2018:1450 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2018:2669 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2018:1323 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2018:2420 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2018:0630 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2018:1525 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2018:1575 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2018:1451 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2018:0629 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2018:0628 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2018:0582 (opens in a new tab)vendor-advisoryx_transferred
• 103737 (opens in a new tab)vdb-entryx_transferred
• RHSA-2018:2419 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2018:1447 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2018:1247 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2018:0627 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2018:2930 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2018:1249 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2018:0592 (opens in a new tab)vendor-advisoryx_transferred
• [infra-devnull] 20190321 [GitHub] [tika] dadoonet opened pull request #268: Update slf4j to 1.8.0-beta4 (opens in a new tab)mailing-listx_transferred
• [infra-devnull] 20190321 [GitHub] [tika] grossws commented on issue #268: Update slf4j to 1.8.0-beta4 (opens in a new tab)mailing-listx_transferred
• RHSA-2019:2413 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:3140 (opens in a new tab)vendor-advisoryx_transferred
• https://www.oracle.com/security-alerts/cpujul2020.html (opens in a new tab)x_transferred
• https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html (opens in a new tab)x_transferred
• https://jira.qos.ch/browse/SLF4J-430 (opens in a new tab)x_transferred
• https://github.com/qos-ch/slf4j/commit/d2b27fba88e983f921558da27fc29b5f5d269405 (opens in a new tab)x_transferred
• [hadoop-common-dev] 20200824 [jira] [Created] (HADOOP-17220) Upgrade slf4j to 1.7.30 ( To Adress: CVE-2018-8088) (opens in a new tab)mailing-listx_transferred
• [hadoop-common-issues] 20200824 [jira] [Created] (HADOOP-17220) Upgrade slf4j to 1.7.30 ( To Adress: CVE-2018-8088) (opens in a new tab)mailing-listx_transferred
• [hadoop-common-issues] 20200824 [jira] [Updated] (HADOOP-17220) Upgrade slf4j to 1.7.30 ( To Adress: CVE-2018-8088) (opens in a new tab)mailing-listx_transferred
• [hadoop-common-issues] 20200824 [jira] [Commented] (HADOOP-17220) Upgrade slf4j to 1.7.30 ( To Adress: CVE-2018-8088) (opens in a new tab)mailing-listx_transferred
• [hadoop-common-commits] 20200824 [hadoop] branch branch-3.3 updated: HADOOP-17220. Upgrade slf4j to 1.7.30 ( To Address: CVE-2018-8088). Contributed by Brahma Reddy Battula. (opens in a new tab)mailing-listx_transferred
• [hadoop-common-issues] 20200824 [jira] [Updated] (HADOOP-17220) Upgrade slf4j to 1.7.30 ( To Address: CVE-2018-8088) (opens in a new tab)mailing-listx_transferred
• [hadoop-common-commits] 20200824 [hadoop] branch trunk updated: HADOOP-17220. Upgrade slf4j to 1.7.30 ( To Address: CVE-2018-8088). Contributed by Brahma Reddy Battula. (opens in a new tab)mailing-listx_transferred
• [logging-notifications] 20200825 [jira] [Commented] (LOG4J2-2329) Fix dependency in log4j-slf4j-impl to slf4j due to CVE-2018-8088 (opens in a new tab)mailing-listx_transferred
• https://www.oracle.com/security-alerts/cpuoct2020.html (opens in a new tab)x_transferred
• [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list (opens in a new tab)mailing-listx_transferred
• [pulsar-commits] 20210127 [GitHub] [pulsar] GLouMcK opened a new issue #9347: Security Vulnerabilities - Black Duck Scan (opens in a new tab)mailing-listx_transferred
• [iotdb-notifications] 20210325 [jira] [Created] (IOTDB-1258) jcl-over-slf4j have Security Vulnerabilities CVE-2018-8088 (opens in a new tab)mailing-listx_transferred
• [iotdb-reviews] 20210325 [GitHub] [iotdb] wangchao316 opened a new pull request #2906: [IOTDB-1258] jcl-over-slf4j have security vulnerabilities CVE-2018-8088 (opens in a new tab)mailing-listx_transferred
• [iotdb-reviews] 20210327 [GitHub] [iotdb] wangchao316 closed pull request #2906: [IOTDB-1258] jcl-over-slf4j have security vulnerabilities CVE-2018-8088 (opens in a new tab)mailing-listx_transferred
• [iotdb-reviews] 20210327 [GitHub] [iotdb] wangchao316 opened a new pull request #2906: [IOTDB-1258] jcl-over-slf4j have security vulnerabilities CVE-2018-8088 (opens in a new tab)mailing-listx_transferred
• [zookeeper-issues] 20210327 [jira] [Created] (ZOOKEEPER-4264) Apache Zookeeper 3.6.2 - slf4j 1.7.25 has security vulnerability CVE-2018-8088 (opens in a new tab)mailing-listx_transferred
• [zookeeper-issues] 20210327 [jira] [Updated] (ZOOKEEPER-4264) Apache Zookeeper 3.6.2 - slf4j 1.7.25 has security vulnerability CVE-2018-8088 (opens in a new tab)mailing-listx_transferred
• [zookeeper-dev] 20210327 [jira] [Created] (ZOOKEEPER-4264) Apache Zookeeper 3.6.2 - slf4j 1.7.25 has security vulnerability CVE-2018-8088 (opens in a new tab)mailing-listx_transferred
• [zookeeper-issues] 20210328 [jira] [Commented] (ZOOKEEPER-4264) Apache Zookeeper 3.6.2 - slf4j 1.7.25 has security vulnerability CVE-2018-8088 (opens in a new tab)mailing-listx_transferred
• [iotdb-reviews] 20210328 [GitHub] [iotdb] HTHou merged pull request #2906: [IOTDB-1258] jcl-over-slf4j have security vulnerabilities CVE-2018-8088 (opens in a new tab)mailing-listx_transferred
• [iotdb-commits] 20210328 [iotdb] branch master updated: [IOTDB-1258] jcl-over-slf4j have security vulnerabilities CVE-2018-8088 (#2906) (opens in a new tab)mailing-listx_transferred
• [flink-dev] 20210720 [jira] [Created] (FLINK-23444) Slf4j 1.7.15 has the high-risk vulnerability CVE-2018-8088 (opens in a new tab)mailing-listx_transferred
• [flink-issues] 20210720 [jira] [Created] (FLINK-23444) Slf4j 1.7.15 has the high-risk vulnerability CVE-2018-8088 (opens in a new tab)mailing-listx_transferred
• [flink-issues] 20210721 [jira] [Commented] (FLINK-23444) Slf4j 1.7.15 has the high-risk vulnerability CVE-2018-8088 (opens in a new tab)mailing-listx_transferred
• [flink-issues] 20210725 [jira] [Commented] (FLINK-23444) Slf4j 1.7.15 has the high-risk vulnerability CVE-2018-8088 (opens in a new tab)mailing-listx_transferred
• [flink-issues] 20210804 [jira] [Closed] (FLINK-23444) Slf4j 1.7.15 has the high-risk vulnerability CVE-2018-8088 (opens in a new tab)mailing-listx_transferred
• https://www.oracle.com/security-alerts/cpuoct2021.html (opens in a new tab)x_transferred
• https://www.slf4j.org/news.html (opens in a new tab)x_transferred
• https://security.netapp.com/advisory/ntap-20231227-0010/ (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-w77p-8cfg-2x43 (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2018-8088](https://trackcve.app/badge/CVE-2018-8088.svg)](https://trackcve.app/cve/CVE-2018-8088)

Record last updated 5 Aug 2024, 06:46 UTC.