slf4j-1.7.4-4.el7

The Simple Logging Facade for Java or (SLF4J) is a simple facade for various
logging APIs allowing the end-user to plug in the desired implementation at
deployment time. SLF4J also allows for a gradual migration path away from
Jakarta Commons Logging (JCL).

Security Fix(es):

* slf4j: Deserialisation vulnerability in EventData constructor can allow for
arbitrary code execution (CVE-2018-8088)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in the
References section.

Asianux would like to thank Chris McCown for reporting this issue.

CVE-2018-8088
org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before
1.8.0-beta2 allows remote attackers to bypass intended access restrictions via
crafted data.