NewsSiemens ProductCERT

SSA-371761 V1.0: Arbitrary Code Execution Vulnerability in the Logback Component of SINEC NMS before V1.0.3

SINEC NMS versions before V1.0.3 are affected by a vulnerability in the logback component (CVE-2021-42550) that could allow attackers with write access to the logback configuration file to execute arbitrary code on the system. Siemens has released an update for SINEC NMS and recommends to update to the latest version.

CVE-2021-42550QOS.ch Logback: Deserialisierung nicht vertrauenswürdiger Daten
CVE-2021-42550Red Hat Security Advisory: Red Hat Process Automation Manager 7.12.1 security update
CVE-2021-42550Red Hat Security Advisory: Satellite 6.11 Release
CVE-2021-42550Red Hat Security Advisory: Red Hat Fuse 7.11.0 release and security update
CVE-2021-42550Red Hat Security Advisory: Red Hat Decision Manager 7.12.1 security update
CVE-2021-42550Red Hat FUSE: Mehrere Schwachstellen
CVE-2021-42550Deserialization of Untrusted Data in logback
CVE-2021-42550Siemens ProductCERT Advisory SSA-371761
CVE-2021-42550QOS.ch Logback: Deserialisierung nicht vertrauenswürdiger Daten

Affected vendors and products

NetApp Cloud Manager
NetApp NetApp Service Level Manager
NetApp NetApp Snap Creator Framework
Qos Logback
Red Hat Red Hat Satellite
Siemens Sinec Nms

Other advisories

MediumCVE-2021-42550Siemens ProductCERT Advisory SSA-371761

Source: https://cert-portal.siemens.com/productcert/pdf/ssa-371761.pdf

Linked advisories

Affected vendors and products

More on SSA-371761

Other advisories