SUSE-SU-2018:1744-1

Details

Description of the patch:

This update for slf4j fixes the following issues:

CVE-2018-8088: Disallow EventData deserialization by default to avoid arbitrary code execution using serialized data (bsc#1085970)

Affected Packages

slf4j

SUSE Linux Enterprise Software Development Kit 12 SP3SUSE Manager Server 3.0SUSE Manager Server 3.1SUSE OpenStack Cloud 8SUSE OpenStack Cloud Crowbar 8

Fixed in:

1.7.12-3.3.1

References

ADVISORY

https://bugzilla.suse.com/1085970

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2018-June/004199.html

ADVISORY

https://www.suse.com/security/cve/CVE-2018-8088/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2018/suse-su-20181744-1/