December 2021 - logback-dev

[qos-ch/logback] ef4fc4: hanrdening jndi calls
by Ceki Gülcü 16 Dec '21

16 Dec '21

Branch: refs/heads/master Home: https://github.com/qos-ch/logback Commit: ef4fc4186b74b45ce80d86833820106ff27edd42 https://github.com/qos-ch/logback/commit/ef4fc4186b74b45ce80d86833820106ff2… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-16 (Thu, 16 Dec 2021) Changed paths: M logback-classic/src/main/java/ch/qos/logback/classic/ClassicConstants.java M logback-classic/src/main/java/ch/qos/logback/classic/selector/ContextJNDISelector.java M logback-classic/src/main/java/ch/qos/logback/classic/util/JNDIUtil.java M logback-core/src/main/java/ch/qos/logback/core/util/OptionHelper.java M logback-site/src/site/pages/news.html Log Message: ----------- hanrdening jndi calls Signed-off-by: Ceki Gulcu <ceki(a)qos.ch>

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 16 Dec '21

16 Dec '21

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 16 Dec '21

16 Dec '21

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 16 Dec '21

16 Dec '21

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 16 Dec '21

16 Dec '21

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 16 Dec '21

16 Dec '21

1 0

[JIRA] Updates for LOGBACK-1593: sessionViaJNDI function of SMTPAppender may suffers from jndi injections
by QOS.CH (JIRA) 16 Dec '21

16 Dec '21

logback / LOGBACK-1593 [Open] sessionViaJNDI function of SMTPAppender may suffers from jndi injections ============================== Here's what changed in this issue in the last few minutes. This issue has been created This issue is now assigned to you. View or comment on issue using this link https://jira.qos.ch/browse/LOGBACK-1593 ============================== Issue created ------------------------------ Diggid created this issue on 16/Dec/21 6:49 AM Summary: sessionViaJNDI function of SMTPAppender may suffers from jndi injections Issue Type: Bug Assignee: Logback dev list Attachments: poc.pdf Components: logback-classic, logback-core Created: 16/Dec/21 6:49 AM Labels: smtpappender Priority: Critical Reporter: Diggid Description: Hello friend! Similar to [CVE-2021-4104|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4104] in logback's SMTPAppender, it is possible to override the configuration to enable sessionViaJNDI and specify jndiLocation as a malicious jndi server, leading to jndi injection and even RCE. more details in the attached pdf ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 16 Dec '21

16 Dec '21

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 16 Dec '21

16 Dec '21

1 0

[qos-ch/logback] 2c032e: more work on microseconds
by Ceki Gülcü 15 Dec '21

15 Dec '21

Branch: refs/heads/master Home: https://github.com/qos-ch/logback Commit: 2c032ed99954bd2d8b44765460af2234f99d4cbe https://github.com/qos-ch/logback/commit/2c032ed99954bd2d8b44765460af2234f9… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-16 (Thu, 16 Dec 2021) Changed paths: M logback-classic/src/test/java/ch/qos/logback/classic/PatternLayoutTest.java M logback-site/src/site/pages/manual/layouts.html Log Message: ----------- more work on microseconds Signed-off-by: Ceki Gulcu <ceki(a)qos.ch>

1 0