December 2021 - logback-dev

[JIRA] (LOGBACK-1591) Possibility of vulnerability - registered as CVE-2021-42550
by QOS.CH (JIRA) 17 Dec '21

17 Dec '21

1 0

[qos-ch/logback] 1502cb: minor doc fixes
by Ceki Gülcü 17 Dec '21

17 Dec '21

Branch: refs/heads/master Home: https://github.com/qos-ch/logback Commit: 1502cba4c1dfd135b2e715bc0cf80c0045d4d128 https://github.com/qos-ch/logback/commit/1502cba4c1dfd135b2e715bc0cf80c0045… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-17 (Fri, 17 Dec 2021) Changed paths: M logback-site/src/site/pages/news.html M pom.xml Log Message: ----------- minor doc fixes Signed-off-by: Ceki Gulcu <ceki(a)qos.ch>

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability - registered as CVE-2021-42550
by QOS.CH (JIRA) 17 Dec '21

17 Dec '21

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability - registered as CVE-2021-42550
by QOS.CH (JIRA) 17 Dec '21

17 Dec '21

1 0

Security Fix - logback 1.2.9 and 1.3.0-alpha11
by Ceki Gülcü 17 Dec '21

17 Dec '21

Hello all, Since the publication of log4shell attack, a vulnerability of lesser importance has been reported against logback, namely CVE-2021-42550. See https://cve.report/CVE-2021-42550 for a description. See https://github.com/cn-panda/logbackRceDemo for a demo of the attack. In response, we have made several changes in logback components as to harden them. We have also dropped Groovy configuration support with no replacement. Please refer to the news page for more details. http://logback.qos.ch/news.html Even if the vulnerability found in logback is less threatening, we highly recommend that you upgrade to logback version 1.2.9 if you are on the 1.2.x series and to version 1.3.0-alpha11 if you are already on 1.3.x series. Best regards, -- Ceki Gülcü Please contact suppport(at)qos.ch for donations, sponsorship or support contracts related to SLF4J or logback projects.

1 0

[qos-ch/logback] c43bd3: fix JNDI call in SMTPAppedner
by Ceki Gülcü 16 Dec '21

16 Dec '21

Branch: refs/heads/master Home: https://github.com/qos-ch/logback Commit: c43bd30e1092b89bb91f5fb6a28310956b3bac61 https://github.com/qos-ch/logback/commit/c43bd30e1092b89bb91f5fb6a28310956b… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-16 (Thu, 16 Dec 2021) Changed paths: M logback-classic/src/main/java/ch/qos/logback/classic/ClassicConstants.java M logback-classic/src/main/java/ch/qos/logback/classic/joran/action/InsertFromJNDIAction.java M logback-classic/src/main/java/ch/qos/logback/classic/selector/ContextJNDISelector.java M logback-classic/src/main/java/ch/qos/logback/classic/selector/servlet/ContextDetachingSCL.java R logback-classic/src/main/java/ch/qos/logback/classic/util/JNDIUtil.java M logback-core/src/main/java/ch/qos/logback/core/CoreConstants.java M logback-core/src/main/java/ch/qos/logback/core/net/SMTPAppenderBase.java A logback-core/src/main/java/ch/qos/logback/core/util/JNDIUtil.java A logback-core/src/test/java/ch/qos/logback/core/util/JNDIUtilTest.java Log Message: ----------- fix JNDI call in SMTPAppedner Signed-off-by: Ceki Gulcu <ceki(a)qos.ch>

1 0

[qos-ch/logback] 12a980: start work on 1.2.9[D
by Ceki Gülcü 16 Dec '21

16 Dec '21

Branch: refs/heads/branch_1.2.x Home: https://github.com/qos-ch/logback Commit: 12a980d412d29aff29c5386a9f3a601804f6334f https://github.com/qos-ch/logback/commit/12a980d412d29aff29c5386a9f3a601804… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-15 (Wed, 15 Dec 2021) Changed paths: M logback-access/pom.xml M logback-classic/pom.xml M logback-core/pom.xml M logback-examples/pom.xml M logback-site/pom.xml M pom.xml Log Message: ----------- start work on 1.2.9[D Signed-off-by: Ceki Gulcu <ceki(a)qos.ch> Commit: 5249ff3c1c822eb5c6c8966c6f4233984f21d441 https://github.com/qos-ch/logback/commit/5249ff3c1c822eb5c6c8966c6f4233984f… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-15 (Wed, 15 Dec 2021) Changed paths: M logback-classic/src/main/java/ch/qos/logback/classic/ClassicConstants.java M logback-classic/src/main/java/ch/qos/logback/classic/joran/action/InsertFromJNDIAction.java M logback-classic/src/main/java/ch/qos/logback/classic/selector/ContextJNDISelector.java M logback-classic/src/main/java/ch/qos/logback/classic/util/JNDIUtil.java M logback-classic/src/test/java/ch/qos/logback/classic/selector/ContextDetachingSCLTest.java M logback-classic/src/test/java/ch/qos/logback/classic/selector/ContextJNDISelectorTest.java Log Message: ----------- Merge branch 'branch_1.2.x' of github.com:qos-ch/logback into branch_1.2.x Commit: 3b9cd0efe0b3390026a04a6092aa03e433ddd330 https://github.com/qos-ch/logback/commit/3b9cd0efe0b3390026a04a6092aa03e433… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-16 (Thu, 16 Dec 2021) Changed paths: M logback-access/pom.xml M logback-classic/pom.xml R logback-classic/src/main/groovy/ch/qos/logback/classic/boolex/EvaluatorTemplate.groovy R logback-classic/src/main/groovy/ch/qos/logback/classic/gaffer/AppenderDelegate.groovy R logback-classic/src/main/groovy/ch/qos/logback/classic/gaffer/ComponentDelegate.groovy R logback-classic/src/main/groovy/ch/qos/logback/classic/gaffer/ConfigurationContributor.groovy R logback-classic/src/main/groovy/ch/qos/logback/classic/gaffer/ConfigurationDelegate.groovy R logback-classic/src/main/groovy/ch/qos/logback/classic/gaffer/GafferConfigurator.groovy R logback-classic/src/main/groovy/ch/qos/logback/classic/gaffer/NestedType.groovy R logback-classic/src/main/groovy/ch/qos/logback/classic/gaffer/PropertyUtil.groovy M logback-classic/src/main/java/ch/qos/logback/classic/ClassicConstants.java R logback-classic/src/main/java/ch/qos/logback/classic/boolex/GEventEvaluator.java R logback-classic/src/main/java/ch/qos/logback/classic/gaffer/GafferUtil.java M logback-classic/src/main/java/ch/qos/logback/classic/joran/ReconfigureOnChangeTask.java M logback-classic/src/main/java/ch/qos/logback/classic/joran/action/InsertFromJNDIAction.java M logback-classic/src/main/java/ch/qos/logback/classic/selector/ContextJNDISelector.java M logback-classic/src/main/java/ch/qos/logback/classic/selector/servlet/ContextDetachingSCL.java M logback-classic/src/main/java/ch/qos/logback/classic/turbo/ReconfigureOnChangeFilter.java M logback-classic/src/main/java/ch/qos/logback/classic/util/ContextInitializer.java R logback-classic/src/main/java/ch/qos/logback/classic/util/JNDIUtil.java R logback-classic/src/test/groovy/ch/qos/logback/classic/gaffer/ConfigurationDelegateTest.groovy R logback-classic/src/test/groovy/ch/qos/logback/classic/gaffer/GafferConfiguratorTest.groovy R logback-classic/src/test/groovy/ch/qos/logback/classic/gaffer/PropertyUtilTest.groovy R logback-classic/src/test/groovy/issues/logback811/LineNumTest.groovy R logback-classic/src/test/groovy/issues/logback811/logback._groovy M logback-classic/src/test/java/ch/qos/logback/classic/LoggerContextConcurrentResetTest.java R logback-classic/src/test/java/ch/qos/logback/classic/boolex/GEventEvaluatorTest.java M logback-classic/src/test/java/ch/qos/logback/classic/joran/ReconfigureOnChangeTaskTest.java M logback-classic/src/test/java/ch/qos/logback/classic/turbo/ReconfigureOnChangeTest.java M logback-classic/src/test/java/ch/qos/logback/classic/util/ContextInitializerTest.java M logback-core/pom.xml M logback-core/src/main/java/ch/qos/logback/core/CoreConstants.java M logback-core/src/main/java/ch/qos/logback/core/net/SMTPAppenderBase.java A logback-core/src/main/java/ch/qos/logback/core/util/JNDIUtil.java A logback-core/src/test/java/ch/qos/logback/core/util/JNDIUtilTest.java M logback-examples/pom.xml M logback-site/pom.xml M pom.xml Log Message: ----------- even more hardened Signed-off-by: Ceki Gulcu <ceki(a)qos.ch> Compare: https://github.com/qos-ch/logback/compare/54e81d74a930...3b9cd0efe0b3

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability - registered as CVE-2021-42550
by QOS.CH (JIRA) 16 Dec '21

16 Dec '21

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability - registered as CVE-2021-42550
by QOS.CH (JIRA) 16 Dec '21

16 Dec '21

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability - registered as CVE-2021-42550
by QOS.CH (JIRA) 16 Dec '21

16 Dec '21

1 0