ECHO-50cb-9ed7-3fa1
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-50cb-9ed7-3fa1.json
- JSON Data
- https://api.osv.dev/v1/vulns/ECHO-50cb-9ed7-3fa1
- Upstream
- Withdrawn
- 2026-11-12T08:00:07Z
- Published
- 2024-12-19T18:31:37Z
- Modified
- 2026-11-12T08:20:19Z
- Summary
- Expression language injection through JaninoEventEvaluator in a configuration file. Fixed on the 1.3 line in 1.3.15 (GHSA lists logback-core < 1.3.15) by commit c17e58838, which deletes JaninoEventEvaluator and logback-core's ch.qos.logback.core.boolex.JaninoEventEvaluatorBase. Neither class exists in the 1.3.15 tag (`git ls-tree -r v_1.3.15 | grep JaninoEventEvaluator` is empty). trivy matches only the 1.5.13 fixed version.
- Details
- References