{"action":"Upgrade logback to 1:1.6.3-1 or later.","affected":[{"fixed":"1:1.6.3-1","introduced":"0"}],"component":"logback","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["1:1.6.3-1"],"id":"tcs_01M5NK2G02XT6ZY2S124HTSRJ6","modified_at":"2026-10-15T18:00:07.689154882Z","published_at":"2024-12-19T17:15:08.930Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2024-12801","https://security-tracker.debian.org/tracker/CVE-2024-12801"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2024-12801#Debian:14/logback","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2024-12801"}],"summary":"Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback co"}