Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

qos-ch/slf4j

              master @ 6140045
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Deserialization of Untrusted Data: 1 prior fix. Scrutinize any change in this area.

slf4j-api/src/main/java/org/slf4j/helpers/BasicMDCAdapter.java: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Deserialization of Untrusted Data: The EventData utility class used java.beans.XMLDecoder to parse user-supplied data, exposing applications to arbitrary code execution through crafted XML payloads. While the class was removed to address CVE-2018-8088, similar custom deserialization points within optional extensions pose a significant threat.

Information Disclosure: Improper thread-local state management in BasicMDCAdapter allowed child threads to share the parent thread's Mapped Diagnostic Context (MDC) map reference directly. This shared state could leak sensitive context data across concurrent execution boundaries if the collection is mutated.