- announce - mailman3.qos.ch

Release of reload4j version 1.2.18.2
by QOS.ch annoucements 21 Jan '22

21 Jan '22

Hello all, I am very happy to announce the immediate availability of reload4j version 1.2.18.2. It is intended as a drop-in replacement for log4j version 1.2.17. By drop in, we mean the replacement of log4j.jar with reload4j.jar in your build with no source code changes in .java files being necessary. Reload4j has the following Maven coordinates: <dependency> <groupId>ch.qos.reload4j</groupId> <artifactId>reload4j</artifactId> <version>1.2.18.2</version> </dependency> Reload4j was built using Java 8 but targets Java 1.5. Version 1.2.8.2 corrects the following issues: The unit tests were updated but no actual code was changed except for the removal of NTEventAppender and the correction of the following issues: - Standardize and sanitize the build - CVE-2021-4104 (JMSAppender) - fixed in 1.2.18.0 by hardening - CVE-2022-23302 (JMSSink) - fixed in 1.2.18.1 by hardening - CVE-2019-17571 (SocketServer) - fixed in 1.2.18.0 by hardening - CVE-2020-9493 CVE-2022-23307 (Chainsaw) - fixed in 1.2.18.1 by hardening - CVE-2022-23305 (JDBCAppender) - fixed in 1.2.18.1 by hardening - broken MDC in newer JDKs - fixed in 1.2.18.0 Thanks to the remarkable work of Vladimir Sitnikov, JDBCAppender now interprets the SQL expression on the fly so as to insert new events using PreparedStartement instances. Note that the table column types are restricted to those types compatible with Java's String. Project web-site: https://reload4j.qos.ch/ Source repository: https://github.com/qos-ch/reload4j With release 1.2.18.2 we have addressed the most pressing issues regarding log4j 1.x vulnerabilities. As both log4j 1.x and reload4j do *not* offer a message lookup mechanism, they did not suffer from the notorious log4shell vulnerability. Donations and sponsorship You can also support SLF4J/logback/reload4j projects via donations and sponsorship. We thank our current supporters and sponsors for their continued contributions. Sponsorship link: https://github.com/sponsors/qos-ch?o=esb Announcement mailing list: You can receive SLF4J/logback/reload4j related announcements by subscribing QOS.ch announce list, please visit the following URL. http://www.qos.ch/mailman/listinfo/announce Enjoy, -- Ceki Gülcü

1 0

Release of reload4j version 1.2.18.1
by QOS.ch annoucements 19 Jan '22

19 Jan '22

Hello all, I am very happy to announce the immediate availability of reload4j version 1.2.18.1. It is intended as a drop-in replacement for log4j version 1.2.17. By drop in, we mean the replacement of log4j.jar with reload4j.jar in your build with no source code changes in .java files being necessary. Reload4j has the following Maven coordinates: <dependency> <groupId>ch.qos.reload4j</groupId> <artifactId>reload4j</artifactId> <version>1.2.18.1</version> </dependency> Reload4j was built using Java 8 but targets Java 1.5. Version 1.2.8.0 and 1.2.18.1 correct the following issues: The unit tests were updated but no actual code was changed except for the removal of NTEventAppender and the correction of the following issues: - Standardize and sanitize the build - CVE-2021-4104 (JMSAppender) - fixed in 1.2.18.0 by hardening - CVE-2022-23302 (JMSSink) - fixed in 1.2.18.1 by hardening - CVE-2019-17571 (SocketServer) - fixed in 1.2.18.0 by hardening - CVE-2020-9493 CVE-2022-23307 (Chainsaw) - fixed in 1.2.18.1 by hardening - CVE-2022-23305 (JDBCAppender) - fixed in 1.2.18.1 by *removal* - broken MDC in newer JDKs - fixed in 1.2.18.0 In the absence of a robust and well tested countermeasure, JDBCAppender has been removed to prevent SQL injection attacks. We have a proposed countermeasure which may yet salvage JDBCAppender. https://github.com/qos-ch/reload4j/pull/26 Project web-site: https://reload4j.qos.ch/ Source repository: https://github.com/qos-ch/reload4j With release 1.2.18.0 and 1.2.18.1 we have addressed the most pressing issues regarding log4j 1.x vulnerabilities. As both log4j 1.x and reload4j do *not* offer a message lookup mechanism, they did not suffer from the notorious log4shell vulnerability. Donations and sponsorship You can also support SLF4J/logback/reload4j projects via donations and sponsorship. We thank our current supporters and sponsors for their continued contributions. Sponsorship link: https://github.com/sponsors/qos-ch?o=esb Announcement mailing list: You can receive SLF4J/logback/reload4j related announcements by subscribing QOS.ch announce list, please visit the following URL. http://www.qos.ch/mailman/listinfo/announce Enjoy, -- Ceki Gülcü

1 0

Release of SLF4J version 1.7.33
by QOS.ch annoucements 13 Jan '22

13 Jan '22

Hello all, I am very happy to announce the immediate availability of SLF4J version 1.7.33. This release adds the "slf4j-reload4j" module which delegates logging processing to the reload4j logging framework. The reload4j project is a fork of Apache log4j version 1.2.17 with the goal of fixing pressing security issues. It is intended as a drop-in replacement for log4j version 1.2.17. By drop-in, we mean the replacement of log4j.jar with reload4j.jar in your build with no source code changes in .java files being necessary. Reload4j project web site: https://reload4j.qos.ch/ If you are using slf4j-log4j12 as your binding of choice, please consider using slf4j-reload4j instead. Please refer to the the news page for more details on this release: http://www.slf4j.org/news.html The relevant artifacts should hit the Maven central repository within the next few hours. The 1.7.x series: The Simple Logging Facade for Java or (SLF4J) serves as a simple facade or abstraction for various logging frameworks, e.g. java.util.logging, log4j 1.x, reload4j and logback, allowing the end user to plug in the desired logging framework at deployment time. Binary compatibility: Mixing mixing different versions of slf4j-api.jar and SLF4J binding can cause problems. For example, if you are using slf4j-api-1.7.1.jar, then you should also use slf4j-simple-1.7.1.jar, using slf4j-simple-1.5.5.jar will not work. >From the client's perspective all versions of slf4j-api are compatible. Client code compiled with slf4j-api-N.jar will run perfectly fine with slf4j-api-M.jar for any N and M. You only need to ensure that the version of your binding matches that of the slf4j-api.jar. You do not have to worry about the version of slf4j-api.jar used to compile a given dependency in your project. You can always use *any* version of slf4j-api.jar, and as long as the version of slf4j-api.jar and its binding match, you should be fine. Downloading SLF4J: You can download SLF4J, including full source code, class files and documentation from Maven central under the "org.slf4j" groupId. Announcement mailing list: You can receive SLF4J related announcements by subscribing to the SLF4J announce mailing list. To subscribe to QOS.ch announce list, please visit the following URL. http://www.qos.ch/mailman/listinfo/announce Donations and sponsorship You can also support SLF4J/logback/reload4j projects via donations and sponsorship. We thank our current supporters and sponsors for their continued contributions. https://github.com/sponsors/qos-ch Enjoy, -- Ceki Gülcü Please contact support(at)qos.ch for donations, sponsorship or support contracts related to SLF4J/logback/reload4j projects.

1 0

Release of reload4j version 1.2.8.0
by QOS.ch annoucements 12 Jan '22

12 Jan '22

Hello all, I am very happy to announce the immediate availability of reload4j version 1.2.8.0. It is intended as a drop-in replacement for log4j version 1.2.17. By drop in, we mean the replacement of log4j.jar with reload4j.jar in your build with no source code changes in .java files being necessary. Reload4j has the following Maven coordinates: <dependency> <groupId>ch.qos.reload4j</groupId> <artifactId>reload4j</artifactId> <version>1.2.18.0</version> </dependency> Reload4j was built using Java 8 but targets Java 1.5. Version 1.2.8.0 corrects the following issues: The unit tests were updated but no actual code was changed except for the removal of NTEventAppender and the correction of the following issues: [REL-1] Standardize and sanitize project folder structure [REL-2] CVE-2021-4104 (JMSAppender vulnerability) [REL-3] CVE-2019-17571 (de-serialization vulnerability in SocketServer aka CVE-2019-17571) [REL-4] MDC breakage in newer JDKs Project web-site: https://reload4j.qos.ch/ Source repository: https://github.com/qos-ch/reload4j Jira: https://jira.qos.ch/ With release 1.2.8.0 we have addressed the most pressing issues regarding log4j 1.x vulnerabilities. Donations and sponsorship You can also support SLF4J/logback/reload4j projects via donations and sponsorship. We thank our current supporters and sponsors for their continued contributions. Sponsorship link: https://github.com/sponsors/qos-ch?o=esb Announcement mailing list: You can receive SLF4J/logback/reload4j related announcements by subscribing QOS.ch announce list, please visit the following URL. http://www.qos.ch/mailman/listinfo/announce Enjoy, -- Ceki Gülcü

1 1

Secuirty Fix - logback 1.2.9 and 1.3.0-alpha11
by QOS.ch annoucements 17 Dec '21

17 Dec '21

Hello all, Since the publication of log4shell attack, a vulnerability of lesser importance has been reported against logback, namely CVE-2021-42550. See https://cve.report/CVE-2021-42550 for a description. See https://github.com/cn-panda/logbackRceDemo for a demo of the attack. In response, we have made several changes in logback components as to harden them. We have also dropped Groovy configuration support with no replacement. Please refer to the news page for more details. http://logback.qos.ch/news.html Even if the vulnerability found in logback is less threatening, we highly recommend that you upgrade to logback version 1.2.9 if you are on the 1.2.x series and to version 1.3.0-alpha11 if you are already on 1.3.x series. Best regards, -- Ceki Gülcü Please contact suppport(at)qos.ch for donations, sponsorship or support contracts related to SLF4J or logback projects.

1 0

SECURITY FIX - Release of logback version 1.2.8 with security Fixes
by QOS.ch annoucements 14 Dec '21

14 Dec '21

== Includes security fixes ==== Hello all, In the wake of CVE-2021-44228, a serialization related vulnerability has been reported which affects logback. In response to this vulnerability we have disabled all JNDI lookup code in logback until further notice. This impacts ContextJNDISelector and <insertFromJNDI> element in configuration files. We have also removed all database (JDBC) related code in the project with no replacement. We note that the vulnerability mentioned in LOGBACK-1591 [1] requires write access to logback's configuration file as a prerequisite. An demo of the vulnerability can be found at [2]. We urge you to upgrade to logback 1.2.8 as soon as possible. A release on the 1.3.x branch will follow shorty. As an additional precautionary measure, we also recommend users to set their configuration files as read-only. Best regards, [1] https://jira.qos.ch/browse/LOGBACK-1591 [2] https://github.com/cn-panda/logbackRceDemo -- Ceki Gülcü Please contact sales(at)qos.ch for support related to SLF4J or logback projects.

1 0

Remote code execution vulnerability in log4j 2.x
by QOS.ch annoucements 10 Dec '21

10 Dec '21

Hello all, You might have heard of a Remote code execution (RCE) vulnerability in log4j 2.x, that allows an attacker to execute arbitrary code by controlling the contents of a single logged message. While vulnerabilities are reported now and then, this vulnerability is totally unheard of in its severity. As for logback, while logback claims to be the successor to log4j 1.x, logback is unrelated to log4j 2.x. It does not share code nor vulnerabilities with log4j 2.x. More specifically, logback does not suffer from aforementioned said RCE vulnerability in any shape or form. Unfortunately, the vulnerability exists under SLF4J API when log4j 2.x is used as the back-end implementation. Given the severity of this issue, we encourage you to consider logback as the preferred back-end for SLF4J API. Also note that logback performs significantly better than log4 2.x. Please see the benchmark results at: http://logback.qos.ch/performance.html Better yet, run the benchmark yourself. https://github.com/ceki/logback-perf In our opinion, logging libraries need to be reliable first and foremost with new features added only with extreme care. Best regards, Further references to the RCE vulnerability: https://www.lunasec.io/docs/blog/log4j-zero-day/ https://twitter.com/P0rZ9/status/1468949890571337731 https://github.com/apache/logging-log4j2/pull/608 -- Ceki Gülcü Please contact sales(a)qos.ch for support related to SLF4J or logback projects.

1 0

Release of SLF4J version 2.0.0-alpha5
by QOS.ch annoucements 30 Aug '21

30 Aug '21

Hello all, I am pleased to announce SLF4J 2.0.0-alpha5. This release fixes an issue with Java Platform Logging API (JEP 264) support when running under the class-path (but not the module-path). JEP 264 support is new in SLF4J 2.0.0-alpha4. The 2.0.x series introduces a backward-compatible fluent logging API. By backward-compatible, we mean that existing logging frameworks do not have to be changed in order for the user to benefit from the fluent logging API. However, existing frameworks *must* migrate to the ServiceLoader mechanism. The resulting internal changes are detailed in the FAQ page. http://www.slf4j.org/faq.html#changesInVersion200 The 2.0.x series builds upon the the 1.8.x series which was modularized per Java Platform Module System (JPMS/Jigsaw). The 2.0.x series requires Java 8. Please refer to the the news page for more details on this release: http://www.slf4j.org/news.html Binary compatibility: Mixing mixing different versions of slf4j-api.jar and SLF4J provider can cause problems. For example, if you are using slf4j-api-2.0.0.jar, then you should also use slf4j-simple-2.0.0.jar, using slf4j-simple-1.5.5.jar will not work. With the exception of the fluent API (new in SLF4J 2.0.x), from the client's perspective all versions of slf4j-api are compatible. Client code compiled with slf4j-api-N.jar will run perfectly fine with slf4j-api-M.jar for any N and M. You only need to ensure that the version of your provider matches that of the slf4j-api.jar. You do not have to worry about the version of slf4j-api.jar used to compile a given dependency in your project. You can always use *any* version of slf4j-api.jar, and as long as the version of slf4j-api.jar and its provider match, you should be fine. Downloading SLF4J: You can download SLF4J, including full source code, class files and documentation on our download page: http://www.slf4j.org/download.html Announcement mailing list: You can receive SLF4J related announcements by subscribing to the SLF4J announce mailing list. To subscribe to QOS.ch announce list, please visit the following URL. http://www.qos.ch/mailman/listinfo/announce You may also receive announcements via twitter: https://twitter.com/qos_ch Enjoy, -- Ceki Gülcü

1 0

Release of logback version 1.3.0-alpha10
by QOS.ch annoucements 23 Aug '21

23 Aug '21

Hello all, I am happy to announce the release of logback version 1.3.0-alpha10, the best performing logback yet. It requires slf4j-api version 2.0.0-alpha4 or later. For benchmarking figures please see: http://logback.qos.ch/performance.html This version supports the fluent-API introduced in SLF4J 2.0.x. It also supports Jigsaw/Java9 modularization. Joran, logback's configuration system, has been rewritten to use an internal representation model which can be processed separately. Given the breadth of the changes, support for SiftingAppender and Groovy configuration have been dropped temporarily. No new features are available in this version. Future releases will gradually introduce new features made possible by Joran representation model. The 1.3.x series requires Java 8 at runtime. If you wish to build logback from source, you will need Java 9. Please refer to the news page for precise details. http://logback.qos.ch/news.html You can receive logback related announcements by subscribing to the QOS.ch announce mailing list. To subscribe to QOS.ch announce list, please visit the following URL. http://www.qos.ch/mailman/listinfo/announce You may also receive announcements via twitter by following: https://twitter.com/qos_ch Enjoy, -- Ceki Gülcü

1 0

Release of logback version 1.3.0-alpha8
by QOS.ch annoucements 12 Aug '21

12 Aug '21

Hello all, I am happy to announce the release of logback version 1.3.0-alpha8. It requires slf4j-api version 2.0.0-alpha4 or later. This version supports the fluent-API introduced in SLF4J 2.0.x. It also supports Jigsaw/Java9 modularization. Joran, logback's configuration system, has been rewritten to use an internal representation model which can be processed separately. Given the breadth of the changes, support for SiftingAppender and Groovy configuration have been dropped temporarily. No new features are available in this version. Future releases will gradually introduce new features made possible by Joran representation model. The 1.3.x series requires Java 8 at runtime. If you wish to build logback from source, you will need Java 9. Please refer to the news page for precise details. http://logback.qos.ch/news.html You can receive logback related announcements by subscribing to the QOS.ch announce mailing list. To subscribe to QOS.ch announce list, please visit the following URL. http://www.qos.ch/mailman/listinfo/announce You may also receive announcements via twitter by following: https://twitter.com/qos_ch Enjoy, -- Ceki Gülcü

1 0