CVE-2023-6378

High

Advisory

Published 29 Nov 2023In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.1; base score, highest
EPSS: 0.009; 58th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 357; of 17,781 indexed, latest versions
Container images: 326; deployed by those charts
Fix available: 2 of 2; affected packages

logback serialization vulnerability

Carried by container images the latest versions of 357 of 17,781 indexed charts deploy, on 326 images.

Affected package	Affected versions	Fixed in	Images
logback-coremaven	1.0.11, 1.0.13, 1.1.2, 1.1.3+20 more	1.2.13, 1.3.12, 1.4.12	326
logback-classicmaven	1.0.11, 1.0.13, 1.1.2, 1.1.3+20 more	1.2.13, 1.3.12, 1.4.12	318

OSV records: GHSA-vmq6-5m68-f53m

Charts affected

357 by stars

Chart

Latest

Affected images

Radar Score

sonarqubewebencryptor

6.7.3

1 of 3 See more

sonarqube webencryptor 6.7.3

1 of the 3 container images this version deploys carry CVE-2023-6378.

Container image	Digest	Package	Fixed in
library/sonarqube :8.2-community	a246bc64207e	logback-classic@1.2.3 logback-core@1.2.3	1.2.13 1.2.13

Open the chart page →

5,460

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2023-6378.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	logback-classic@1.2.10 logback-core@1.2.10	1.2.13 1.2.13

Open the chart page →

14,364

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2023-6378.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	logback-classic@1.2.10 logback-core@1.2.10	1.2.13 1.2.13

Open the chart page →

28,605

cadencewenerme

0.23.0

1 of 5 See more

cadence wenerme 0.23.0

1 of the 5 container images this version deploys carry CVE-2023-6378.

Container image	Digest	Package	Fixed in
library/cassandra :3.11.3	ce85468c5bad	logback-classic@1.1.3 logback-core@1.1.3	1.2.13 1.2.13

Open the chart page →

10,127

temporalwenerme

0.15.1

1 of 13 See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2023-6378.

Container image	Digest	Package	Fixed in
library/cassandra :3.11.3	ce85468c5bad	logback-classic@1.1.3 logback-core@1.1.3	1.2.13 1.2.13

Open the chart page →

22,665

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2023-6378.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	logback-classic@1.2.9 logback-core@1.2.9	1.2.13 1.2.13

Open the chart page →

9,248

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2023-6378.

Container image	Digest	Package	Fixed in
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	logback-classic@1.4.11 logback-core@1.4.11	1.4.12 1.4.12

Open the chart page →

11,577

Container images carrying it

326 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
dellcloud/pages :monitor	6ba7b22caacd	logback-classic@1.2.3 logback-core@1.2.3	1.2.13 1.2.13	79
codeurjc/toposervice :v1.0 :v1.23	9fb4c11e6a49	logback-classic@1.4.5 logback-core@1.4.5	1.4.12 1.4.12	13
library/cassandra :3.11.3	ce85468c5bad	logback-classic@1.1.3 logback-core@1.1.3	1.2.13 1.2.13	7
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	logback-classic@1.2.9 logback-core@1.2.9	1.2.13 1.2.13	4
mastercloudapps/planner :v1.23	40a950b311b2	logback-classic@1.2.7 logback-core@1.2.7	1.2.13 1.2.13	4
oscarsotosanchez/toposervice :v1.0	d4d020e9f272	logback-classic@1.2.3 logback-core@1.2.3	1.2.13 1.2.13	4
apache/shenyu-admin :2.4.2	e8b7c4ddd069	logback-classic@1.2.3 logback-core@1.2.3	1.2.13 1.2.13	3
apache/shenyu-bootstrap :2.4.2	0bd3b25c4be4	logback-classic@1.2.3 logback-core@1.2.3	1.2.13 1.2.13	3
codeurjc/planner :v1.0	800cf520c245	logback-classic@1.2.7 logback-core@1.2.7	1.2.13 1.2.13	3
lmenezes/cerebro :0.9.4	7d9e2b77e459	logback-classic@1.2.3 logback-core@1.2.3	1.2.13 1.2.13	3
pavanelthepu/todo-api :1.0.2	f47658e3b24c	logback-classic@1.2.3 logback-core@1.2.3	1.2.13 1.2.13	3
provectuslabs/kafka-ui :latest	8f2ff02d64b0	logback-classic@1.4.11 logback-core@1.4.11	1.4.12 1.4.12	3
supertokens/supertokens-postgresql :3.14	18d34c781347	logback-classic@1.2.3 logback-core@1.2.3	1.2.13 1.2.13	3
apachepulsar/pulsar-manager :v0.1.0	b341ef76a852	logback-classic@1.2.3 logback-core@1.2.3	1.2.13 1.2.13	2
apache/rocketmq :5.4.0	319cd8a81ed1	logback-classic@1.3.5 logback-core@1.3.5	1.3.12 1.3.12	2
apacherocketmq/rocketmq-dashboard :2.1.0	ce78506bd6fe	logback-classic@1.3.5 logback-core@1.3.5	1.3.12 1.3.12	2
bitnamilegacy/zookeeper :3.9.0-debian-11-r11	10ed1ea3c8d1	logback-classic@1.2.10 logback-core@1.2.10	1.2.13 1.2.13	2
dependencytrack/apiserver :4.6.3	485ac0952c02	logback-classic@1.2.11 logback-core@1.2.11	1.2.13 1.2.13	2
dina1993/airports-api :latest	ac731244aed1	logback-classic@1.4.6 logback-core@1.4.6	1.4.12 1.4.12	2
dina1993/airports-consumer :latest	669d146a5e63	logback-classic@1.4.6 logback-core@1.4.6	1.4.12 1.4.12	2
dina1993/airports-producer :latest	3d6b0dac1cb4	logback-classic@1.4.6 logback-core@1.4.6	1.4.12 1.4.12	2
geoservercloud/geoserver-cloud-gateway :1.0-RC3	756559ee788a	logback-classic@1.2.3 logback-core@1.2.3	1.2.13 1.2.13	2
geoservercloud/geoserver-cloud-rest :1.0-RC3	99540eef78ad	logback-classic@1.2.3 logback-core@1.2.3	1.2.13 1.2.13	2
geoservercloud/geoserver-cloud-wcs :1.0-RC3	5c254c53a357	logback-classic@1.2.3 logback-core@1.2.3	1.2.13 1.2.13	2
geoservercloud/geoserver-cloud-webui :1.0-RC3	c687b1cbc891	logback-classic@1.2.3 logback-core@1.2.3	1.2.13 1.2.13	2
geoservercloud/geoserver-cloud-wfs :1.0-RC3	5288f320cf36	logback-classic@1.2.3 logback-core@1.2.3	1.2.13 1.2.13	2
geoservercloud/geoserver-cloud-wms :1.0-RC3	a30a60ac6cd0	logback-classic@1.2.3 logback-core@1.2.3	1.2.13 1.2.13	2
gradiant/opentsdb :2.4.0	c33d53913869	logback-classic@1.0.13 logback-core@1.0.13	1.2.13 1.2.13	2
hookiesolutions/webhookie :latest	0629694246ba	logback-classic@1.2.10 logback-core@1.2.10	1.2.13 1.2.13	2
library/cassandra :3.11.6	5aa8400b4b3b	logback-classic@1.1.3 logback-core@1.1.3	1.2.13 1.2.13	2
library/cassandra :4.1.3	7cbcec0086ac	logback-classic@1.2.9 logback-core@1.2.9	1.2.13 1.2.13	2
linuxserver/ubooquity :2.1.2-ls36	9932d6759112	logback-classic@1.1.3 logback-core@1.1.3	1.2.13 1.2.13	2
nacos/nacos-server :v2.1.0	dcf04549c6d7	logback-classic@1.2.9 logback-core@1.2.9	1.2.13 1.2.13	2
piomin/sample-spring-kotlin-microservice :1.1	871f784dd6bc	logback-classic@1.2.11 logback-core@1.2.11	1.2.13 1.2.13	2
scorpiobroker/scorpio :RegistrySubscriptionManager_2.1.0	01e11d800459	logback-classic@1.2.7 logback-core@1.2.7	1.2.13 1.2.13	2
scorpiobroker/scorpio :eureka-server_2.1.0	3f05a113a4be	logback-classic@1.2.7 logback-core@1.2.7	1.2.13 1.2.13	2
scorpiobroker/scorpio :AtContextServer_2.1.0	5073ceef2fa0	logback-classic@1.2.7 logback-core@1.2.7	1.2.13 1.2.13	2
scorpiobroker/scorpio :gateway_2.1.0	62dae3dd0eeb	logback-classic@1.2.7 logback-core@1.2.7	1.2.13 1.2.13	2
scorpiobroker/scorpio :RegistryManager_2.1.0	a2cfcf0947fd	logback-classic@1.2.7 logback-core@1.2.7	1.2.13 1.2.13	2
scorpiobroker/scorpio :QueryManager_2.1.0	b742a53b2803	logback-classic@1.2.7 logback-core@1.2.7	1.2.13 1.2.13	2
scorpiobroker/scorpio :HistoryManager_2.1.0	b7fe27a06ff5	logback-classic@1.2.7 logback-core@1.2.7	1.2.13 1.2.13	2
scorpiobroker/scorpio :config-server_1.1.0	c46c1517e523	logback-classic@1.2.3 logback-core@1.2.3	1.2.13 1.2.13	2
scorpiobroker/scorpio :SubscriptionManager_2.1.0	e08036670d66	logback-classic@1.2.7 logback-core@1.2.7	1.2.13 1.2.13	2
scorpiobroker/scorpio :EntityManager_2.1.0	f02e8a429a08	logback-classic@1.2.7 logback-core@1.2.7	1.2.13 1.2.13	2
stakater/stakater-nordmart-review :1.0.35	954d2be66e95	logback-classic@1.2.11 logback-core@1.2.11	1.2.13 1.2.13	2
ghcr.io/salaboy/fmtok8s-frontend :v0.1.1	03fd01b4f56e	logback-classic@1.2.11 logback-core@1.2.11	1.2.13 1.2.13	2
adagber/planner :v1.0	e5c1ed097752	logback-classic@1.2.7 logback-core@1.2.7	1.2.13 1.2.13	1
airsonicadvanced/airsonic-advanced :latest	f7cbafac2806	logback-classic@1.2.3 logback-core@1.2.3	1.2.13 1.2.13	1
amartinm82/planner :v2.0	1184353ff57b	logback-classic@1.2.3 logback-core@1.2.3	1.2.13 1.2.13	1
andrianrf/backoffice-be :latest	6036614803d4	logback-classic@1.2.12 logback-core@1.2.12	1.2.13 1.2.13	1