CVE-2018-8088

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 14.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-03-20 · updated 2026-06-17

Description

org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.

Affected products

Oracle Goldengate Application Adapters: 12.3.2.1.0
Oracle Corporation GoldenGate Stream Analytics: before 19.1.0.0.1 — fixed in 19.1.0.0.1
Oracle Corporation Utilities Framework: 4.2.0.2.0, 4.2.0.3.0, 4.3.0.2.0, 4.3.0.3.0, 4.3.0.4.0, 4.3.0.5.0 (+2)
Qos Slf4J: before 1.7.26; 1.8.0-alpha1, 1.8.0-alpha2, 1.8.0-beta1, 1.8.0-beta2 — fixed in 1.7.26
RedHat Enterprise Linux Desktop: 7.0
RedHat Enterprise Linux Eus: 7.4, 7.5, 7.6, 7.7
RedHat Enterprise Linux Server: 7.0
RedHat Enterprise Linux Server Aus: 7.4, 7.6, 7.7
RedHat Enterprise Linux Server Tus: 7.4, 7.6, 7.7
RedHat Enterprise Linux Workstation: 7.0
Red Hat JBoss EAP: 7.1, 6.0.0, 6.4.0
RedHat Virtualization: 4.0
RedHat Virtualization Host: 4.0

How to fix

Upgrade to a fixed version: Oracle Corporation GoldenGate Stream Analytics 19.1.0.0.1; Qos Slf4J 1.7.26. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-8088 or the next vulnerability affects your stack