{"id":"ECHO-50cb-9ed7-3fa1","summary":"Expression language injection through JaninoEventEvaluator in a\nconfiguration file. Fixed on the 1.3 line in 1.3.15 (GHSA lists logback-core\n\u003c 1.3.15) by commit c17e58838, which deletes JaninoEventEvaluator and\nlogback-core's ch.qos.logback.core.boolex.JaninoEventEvaluatorBase. Neither\nclass exists in the 1.3.15 tag (`git ls-tree -r v_1.3.15 | grep JaninoEventEvaluator`\nis empty). trivy matches only the 1.5.13 fixed version.\n","modified":"2026-11-12T08:20:19.263001564Z","published":"2024-12-19T18:31:37Z","withdrawn":"2026-11-12T08:00:07.582Z","upstream":["CVE-2024-12798","GHSA-pr98-23f8-jwxv"],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2024-12798"},{"type":"WEB","url":"https://github.com/advisories/GHSA-pr98-23f8-jwxv"}],"affected":[{"package":{"name":"ch.qos.logback:logback-core","ecosystem":"Echo:Maven","purl":"pkg:maven/ch.qos.logback/logback-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.15+echo.1"}]},{"type":"ECOSYSTEM","events":[{"introduced":"1.3.16"},{"fixed":"1.3.16+echo.1"}]}],"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-50cb-9ed7-3fa1.json"}}],"schema_version":"1.9.2"}