[
https://issues.apache.org/jira/browse/KAFKA-20945?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18105184#comment-18105184
]
Chia-Ping Tsai commented on KAFKA-20945:
----------------------------------------
Excuse me, which Kafka versions are affected? There is no logback-core jar in
the distribution of the trunk branch
{code:java}
chia7712@2001-b400-e3fa-232f-7327-10ec-93ca-a528:~/project/kafka/core/build/distributions/kafka_2.13-4.5.0-SNAPSHOT/libs$
ls | grep log
commons-logging-1.3.5.jar
log4j-1.2-api-2.25.5.jar
log4j-api-2.25.5.jar
log4j-core-2.25.5.jar
log4j-slf4j-impl-2.25.5.jar
scala-logging_2.13-3.9.6.jar
{code}
> [CVE-2026-9828] , [ CVE-2026-10532] [logback-core] [1.5.25]
> ------------------------------------------------------------
>
> Key: KAFKA-20945
> URL: https://issues.apache.org/jira/browse/KAFKA-20945
> Project: Kafka
> Issue Type: Bug
> Reporter: Krishna Chidrawar
> Priority: Major
>
> *Aqua Description :* Deserialization of untrusted data vulnerability in
> QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core)
> modules) allows Object Injection albeit heavily restricted.
> More precisely, an attacker able to influence serialized data sent to
> SimpleSocketServer or SimpleSSLSocketServer can instantiate objects from
> classes in the java.lang and java.util packages that are not explicitly
> blocked.
> Although deserialization is heavily restricted by HardenedObjectInputStream
> and no
> practical way to achieve remote code execution or significant privilege
> escalation has been identified, this issue constitutes a bypass of the
> intended security restrictions.
> This issue affects logback: through 1.5.32 inclusive.
> *NVD URL :* [https://nvd.nist.gov/vuln/detail/CVE-2026-9828]
> *Aqua Description :* Deserialization of untrusted data vulnerability in
> QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core)
> modules) allows Object Injection, albeit heavily restricted.
> More precisely, an attacker able to influence serialized data sent to
> SimpleSocketServer or SimpleSSLSocketServer can instantiate Proxy objects.
> Although deserialization is heavily restricted by HardenedObjectInputStream
> and no
> practical way to achieve remote code execution or significant privilege
> escalation has been identified, this issue constitutes a bypass of the
> intended security restrictions.
> This issue affects logback: through 1.5.33 inclusive.
> *Vendor Statement :* null
> *Vendor URL :* null
> *NVD URL :* [https://nvd.nist.gov/vuln/detail/CVE-2026-10532]
> *Fix Version :* 1.5.35
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
