CVE-2017-5929

Exploitation

Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.

SSVC decision

Not assessed by CISA

EPSS probability

7.50% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 93.9% of scored records. A rank, not a probability.

NVD base score

9.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2017-03-13 06:14Z9 YR AGO

Last updated

2024-08-05 15:18Z2 YR AGO

Reserved

2017-02-07

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

• CWE-502Deserialization of Untrusted DataBase

Data version

5.1

Document digest

43a8be7b170e2a57ffb505edbaaa21a5cb7258908e405ddedfd572df0dc58bee

• access.redhat.comRHSA-2017:1832https://access.redhat.com/errata/RHSA-2017:1832vendor-advisoryx_refsource_REDHAT
• access.redhat.comRHSA-2017:1675https://access.redhat.com/errata/RHSA-2017:1675vendor-advisoryx_refsource_REDHAT
• access.redhat.comRHSA-2018:2927https://access.redhat.com/errata/RHSA-2018:2927vendor-advisoryx_refsource_REDHAT
• logback.qos.chhttps://logback.qos.ch/news.htmlx_refsource_CONFIRM
• access.redhat.comRHSA-2017:1676https://access.redhat.com/errata/RHSA-2017:1676vendor-advisoryx_refsource_REDHAT
• lists.apache.org[cassandra-commits] 20191112 [jira] [Created] (CASSANDRA-15411) [9.8] [CVE-2017-5929] [Cassandra] [2.2.5]https://lists.apache.org/thread.html/a6db61616180d73711d6db25703085940026e2dbc40f153f9d22b203%40%3Ccommits.cassandra.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[cassandra-commits] 20191112 [jira] [Updated] (CASSANDRA-15411) [9.8] [CVE-2017-5929] [Cassandra] [2.2.5]https://lists.apache.org/thread.html/18d509024d9aeb07f0e9579066f80bf5d4dcf20467b0c240043890d1%40%3Ccommits.cassandra.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15421) CVE-2017-5929(QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.)https://lists.apache.org/thread.html/fa4eaaa6ff41ac6f79811e053c152ee89b7c5da8a6ac848ae97df67f%40%3Ccommits.cassandra.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[brooklyn-dev] 20200420 [GitHub] [brooklyn-server] duncangrant opened a new pull request #1091: Update library versions due to CVEshttps://lists.apache.org/thread.html/r967953a14e05016bc4bcae9ef3dd92e770181158b4246976ed8295c9%40%3Cdev.brooklyn.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[mnemonic-dev] 20201202 [GitHub] [mnemonic] yzz127 opened a new pull request #152: MNEMONIC-553: Fix for CVE-2017-5929https://lists.apache.org/thread.html/rbb4dfca2f7e3e8f3570eec21c79832d33a51dfde6762725660b60169%40%3Cdev.mnemonic.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[mnemonic-dev] 20201204 [GitHub] [mnemonic] bigdata-memory merged pull request #152: MNEMONIC-553: Fix for CVE-2017-5929https://lists.apache.org/thread.html/re9b787727291786dfe088e3cd078c7d195c0b5781e15d3cd24a3b2fc%40%3Cdev.mnemonic.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[mnemonic-commits] 20201204 [mnemonic] branch master updated: MNEMONIC-553: Fix for CVE-2017-5929https://lists.apache.org/thread.html/r2c2d57ca180e8173c90fe313ddf8eabbdcf8e3ae196f8b9f42599790%40%3Ccommits.mnemonic.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[cassandra-commits] 20210108 [jira] [Updated] (CASSANDRA-15829) Upgrade to logback 1.2.3 to address CVE-2017-5929https://lists.apache.org/thread.html/rd2227af3c9ada2a72dc72ed05517f5857a34d487580e1f2803922ff9%40%3Ccommits.cassandra.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[cassandra-commits] 20210108 [jira] [Updated] (CASSANDRA-15421) CVE-2017-5929 in 3.11.x (QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.)https://lists.apache.org/thread.html/r0bb19330e48d5ad784fa20dacba9e5538d8d60f5cd9142e0f1432b4b%40%3Ccommits.cassandra.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[cassandra-commits] 20210108 [jira] [Commented] (CASSANDRA-15829) Upgrade to logback 1.2.3 to address CVE-2017-5929https://lists.apache.org/thread.html/r4673642893562c58cbee60c151ded6c077e8a2d02296e862224a9161%40%3Ccommits.cassandra.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[cassandra-commits] 20210111 [jira] [Commented] (CASSANDRA-15829) Upgrade to logback 1.2.3 to address CVE-2017-5929https://lists.apache.org/thread.html/r397bf63783240fbb5713389d3f889d287ae0c11509006700ac720037%40%3Ccommits.cassandra.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[cassandra-commits] 20210111 [jira] [Updated] (CASSANDRA-15411) [9.8] [CVE-2017-5929] [Cassandra] [2.2.5]https://lists.apache.org/thread.html/rc5f0cc2f3b153bdf15ee7389d78585829abc9c7af4d322ba1085dd3e%40%3Ccommits.cassandra.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[cassandra-commits] 20210111 [jira] [Updated] (CASSANDRA-15421) CVE-2017-5929 in 3.11.x (QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.)https://lists.apache.org/thread.html/r718f27bed898008a8e037d9cc848cfc1df4d18abcbaee0cb0c142cfb%40%3Ccommits.cassandra.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[cassandra-commits] 20210111 [jira] [Assigned] (CASSANDRA-15829) Upgrade to logback 1.2.3 to address CVE-2017-5929https://lists.apache.org/thread.html/r2a08573ddee4a86dc96d469485a5843a01710ee0dc2078dfca410c79%40%3Ccommits.cassandra.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[cassandra-commits] 20210111 [jira] [Updated] (CASSANDRA-15829) Upgrade to logback 1.2.3 to address CVE-2017-5929https://lists.apache.org/thread.html/ra007cec726a3927c918ec94c4316d05d1829c49eae8dc3648adc35e2%40%3Ccommits.cassandra.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[cassandra-commits] 20210923 [jira] [Updated] (CASSANDRA-15829) Upgrade to logback 1.2.3 to address CVE-2017-5929https://lists.apache.org/thread.html/r632ec30791b441e2eb5a3129532bf1b689bf181d0ef7daf50bcf0fd6%40%3Ccommits.cassandra.apache.org%3Emailing-listx_refsource_MLIST