December 2021 - logback-dev

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 14 Dec '21

14 Dec '21

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 14 Dec '21

14 Dec '21

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 14 Dec '21

14 Dec '21

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 14 Dec '21

14 Dec '21

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 14 Dec '21

14 Dec '21

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 14 Dec '21

14 Dec '21

1 0

SECURITY FIX - Release of logback version 1.2.8 with security Fixes
by Ceki Gülcü 14 Dec '21

14 Dec '21

== Includes security fixes ==== Hello all, In the wake of CVE-2021-44228, a serialization related vulnerability has been reported which affects logback. In response to this vulnerability we have disabled all JNDI lookup code in logback until further notice. This impacts ContextJNDISelector and <insertFromJNDI> element in configuration files. We have also removed all database (JDBC) related code in the project with no replacement. We note that the vulnerability mentioned in LOGBACK-1591 [1] requires write access to logback's configuration file as a prerequisite. An demo of the vulnerability can be found at [2]. We urge you to upgrade to logback 1.2.8 as soon as possible. A release on the 1.3.x branch will follow shorty. As an additional precautionary measure, we also recommend users to set their configuration files as read-only. Best regards, [1] https://jira.qos.ch/browse/LOGBACK-1591 [2] https://github.com/cn-panda/logbackRceDemo -- Ceki Gülcü Please contact sales(at)qos.ch for support related to SLF4J or logback projects.

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 14 Dec '21

14 Dec '21

1 0

[qos-ch/logback] 119847: prepare release 1.2.8
by Ceki Gülcü 14 Dec '21

14 Dec '21

Branch: refs/heads/branch_1.2.x Home: https://github.com/qos-ch/logback Commit: 119847d9c3efb854d48ae208d6c848492f4024dc https://github.com/qos-ch/logback/commit/119847d9c3efb854d48ae208d6c848492f… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-14 (Tue, 14 Dec 2021) Changed paths: M logback-access/pom.xml M logback-classic/pom.xml M logback-core/pom.xml M logback-examples/pom.xml M logback-site/pom.xml M pom.xml Log Message: ----------- prepare release 1.2.8 Signed-off-by: Ceki Gulcu <ceki(a)qos.ch>

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 14 Dec '21

14 Dec '21

1 0