December 2021 - logback-dev

[qos-ch/logback] 21d772: LOGBACK-1591
by Ceki Gülcü 14 Dec '21

14 Dec '21

Branch: refs/heads/branch_1.2.x Home: https://github.com/qos-ch/logback Commit: 21d772f2bc2ed780b01b4fe108df7e29707763f1 https://github.com/qos-ch/logback/commit/21d772f2bc2ed780b01b4fe108df7e2970… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-14 (Tue, 14 Dec 2021) Changed paths: R logback-access/src/main/java/ch/qos/logback/access/db/DBAppender.java R logback-access/src/main/java/ch/qos/logback/access/db/package.html M logback-access/src/test/java/ch/qos/logback/access/AllAccessTest.java R logback-access/src/test/java/ch/qos/logback/access/db/DBAppenderHSQLTest.java R logback-access/src/test/java/ch/qos/logback/access/db/DBAppenderHSQLTestFixture.java R logback-access/src/test/java/ch/qos/logback/access/db/DBAppenderIntegrationTest.java R logback-access/src/test/java/ch/qos/logback/access/db/PackageTest.java R logback-classic/src/main/java/ch/qos/logback/classic/db/DBAppender.java R logback-classic/src/main/java/ch/qos/logback/classic/db/DBHelper.java R logback-classic/src/main/java/ch/qos/logback/classic/db/SQLBuilder.java R logback-classic/src/main/java/ch/qos/logback/classic/db/package.html M logback-classic/src/main/java/ch/qos/logback/classic/selector/ContextJNDISelector.java M logback-classic/src/main/java/ch/qos/logback/classic/selector/servlet/ContextDetachingSCL.java M logback-classic/src/main/java/ch/qos/logback/classic/util/JNDIUtil.java M logback-classic/src/test/java/ch/qos/logback/classic/AllClassicTest.java R logback-classic/src/test/java/ch/qos/logback/classic/db/DBAppenderH2Test.java R logback-classic/src/test/java/ch/qos/logback/classic/db/DBAppenderH2TestFixture.java R logback-classic/src/test/java/ch/qos/logback/classic/db/DBAppenderHSQLTest.java R logback-classic/src/test/java/ch/qos/logback/classic/db/DBAppenderHSQLTestFixture.java R logback-classic/src/test/java/ch/qos/logback/classic/db/DBAppenderIntegrationTest.java R logback-classic/src/test/java/ch/qos/logback/classic/db/PackageTest.java R logback-classic/src/test/java/ch/qos/logback/classic/db/SQLBuilderTest.java R logback-classic/src/test/java/ch/qos/logback/classic/db/names/DefaultDBNameResolverTest.java R logback-classic/src/test/java/ch/qos/logback/classic/db/names/PackageTest.java R logback-classic/src/test/java/ch/qos/logback/classic/db/names/SimpleDBNameResolverTest.java M logback-classic/src/test/java/ch/qos/logback/classic/selector/ContextDetachingSCLTest.java M logback-classic/src/test/java/ch/qos/logback/classic/selector/ContextJNDISelectorTest.java R logback-core/src/main/java/ch/qos/logback/core/db/BindDataSourceToJNDIAction.java R logback-core/src/main/java/ch/qos/logback/core/db/ConnectionSource.java R logback-core/src/main/java/ch/qos/logback/core/db/ConnectionSourceBase.java R logback-core/src/main/java/ch/qos/logback/core/db/DBAppenderBase.java R logback-core/src/main/java/ch/qos/logback/core/db/DBHelper.java R logback-core/src/main/java/ch/qos/logback/core/db/DataSourceConnectionSource.java R logback-core/src/main/java/ch/qos/logback/core/db/DriverManagerConnectionSource.java R logback-core/src/main/java/ch/qos/logback/core/db/JNDIConnectionSource.java R logback-core/src/main/java/ch/qos/logback/core/db/dialect/DBUtil.java R logback-core/src/main/java/ch/qos/logback/core/db/dialect/H2Dialect.java R logback-core/src/main/java/ch/qos/logback/core/db/dialect/HSQLDBDialect.java R logback-core/src/main/java/ch/qos/logback/core/db/dialect/MsSQLDialect.java R logback-core/src/main/java/ch/qos/logback/core/db/dialect/MySQLDialect.java R logback-core/src/main/java/ch/qos/logback/core/db/dialect/OracleDialect.java R logback-core/src/main/java/ch/qos/logback/core/db/dialect/PostgreSQLDialect.java R logback-core/src/main/java/ch/qos/logback/core/db/dialect/SQLDialect.java R logback-core/src/main/java/ch/qos/logback/core/db/dialect/SQLDialectCode.java R logback-core/src/main/java/ch/qos/logback/core/db/dialect/SQLiteDialect.java R logback-core/src/main/java/ch/qos/logback/core/db/dialect/SybaseSqlAnywhereDialect.java R logback-core/src/main/java/ch/qos/logback/core/db/dialect/package.html R logback-core/src/main/java/ch/qos/logback/core/db/package.html Log Message: ----------- LOGBACK-1591 Signed-off-by: Ceki Gulcu <ceki(a)qos.ch>

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 14 Dec '21

14 Dec '21

1 0

[qos-ch/logback] 31431a: doc improvements
by Ceki Gülcü 14 Dec '21

14 Dec '21

Branch: refs/heads/master Home: https://github.com/qos-ch/logback Commit: 31431a0d0419fd43d2c7c4b1c0d8ec056a129680 https://github.com/qos-ch/logback/commit/31431a0d0419fd43d2c7c4b1c0d8ec056a… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-14 (Tue, 14 Dec 2021) Changed paths: M logback-site/src/site/pages/manual/jmxConfig.html M logback-site/src/site/pages/manual/loggingSeparation.html M logback-site/src/site/pages/manual/mdc.html M logback-site/src/site/pages/manual/migrationFromLog4j.html M logback-site/src/site/pages/manual/onJoran.html M logback-site/src/site/pages/manual/receivers.html M logback-site/src/site/pages/manual/usingSSL.html Log Message: ----------- doc improvements Signed-off-by: Ceki Gulcu <ceki(a)qos.ch>

1 0

[qos-ch/logback] 964041: docs improvements
by Ceki Gülcü 14 Dec '21

14 Dec '21

Branch: refs/heads/master Home: https://github.com/qos-ch/logback Commit: 9640412bc4539339aaeb722a2afadf2df939c62e https://github.com/qos-ch/logback/commit/9640412bc4539339aaeb722a2afadf2df9… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-14 (Tue, 14 Dec 2021) Changed paths: M logback-site/src/site/pages/beagle/index.html M logback-site/src/site/pages/codes.html M logback-site/src/site/pages/css/common.css M logback-site/src/site/pages/css/screen.css M logback-site/src/site/pages/demo.html M logback-site/src/site/pages/dependencies.html M logback-site/src/site/pages/documentation.html M logback-site/src/site/pages/download.html M logback-site/src/site/pages/faq.html M logback-site/src/site/pages/index.html M logback-site/src/site/pages/manual/appenders.html M logback-site/src/site/pages/manual/architecture.html M logback-site/src/site/pages/manual/configuration.html M logback-site/src/site/pages/manual/encoders.html M logback-site/src/site/pages/manual/filters.html M logback-site/src/site/pages/manual/index.html M logback-site/src/site/pages/manual/introduction.html M logback-site/src/site/pages/manual/layouts.html M logback-site/src/site/pages/performance.html M logback-site/src/site/pages/reasonsToSwitch.html M logback-site/src/site/pages/recipes/captureHttp.html M logback-site/src/site/pages/recipes/emailPerTransaction.html M logback-site/src/site/pages/recipes/index.html M logback-site/src/site/pages/templates/creative.js Log Message: ----------- docs improvements Signed-off-by: Ceki Gulcu <ceki(a)qos.ch>

1 0

[JIRA] Updates for LOGBACK-1591: Possibility of vulnerability
by QOS.CH (JIRA) 13 Dec '21

13 Dec '21

logback / LOGBACK-1591 [Open] Possibility of vulnerability ============================== Here's what changed in this issue in the last few minutes. This issue has been created This issue is now assigned to you. View or comment on issue using this link https://jira.qos.ch/browse/LOGBACK-1591 ============================== Issue created ------------------------------ MENNA Stéphane created this issue on 13/Dec/21 10:03 AM Summary: Possibility of vulnerability Issue Type: Bug Affects Versions: 1.3.0-alpha10 Assignee: Logback dev list Components: logback-classic Created: 13/Dec/21 10:03 AM Environment: Android com.github.tony19:logback-android : 2.0.0 org.slf4j:slf4j-api: 1.7.30 Priority: Major Reporter: MENNA Stéphane Description: Hy, we received an alert report about a vulnerability in log4j. I'll like to know if we can have the same in logback link to the report https://www.cert.ssi.gouv.fr/alerte/CERTFR-2021-ALE-022/ ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for LOGBACK-1590: Backport jansi improvement in ConsoleAppender in 1.2.x
by QOS.CH (JIRA) 10 Dec '21

10 Dec '21

logback / LOGBACK-1590 [Open] Backport jansi improvement in ConsoleAppender in 1.2.x ============================== Here's what changed in this issue in the last few minutes. This issue has been created This issue is now assigned to you. View or comment on issue using this link https://jira.qos.ch/browse/LOGBACK-1590 ============================== Issue created ------------------------------ Nils Renaud created this issue on 10/Dec/21 5:07 PM Summary: Backport jansi improvement in ConsoleAppender in 1.2.x Issue Type: Improvement Affects Versions: 1.2.6 Assignee: Logback dev list Components: logback-core Created: 10/Dec/21 5:07 PM Labels: consoleoutput Priority: Major Reporter: Nils Renaud Description: The improvement done in LOGBACK-1392 permits to use JANSI library on unixes environment and thus to detect whether the log output supports ANSI or not (ex : when the standard output is redirected to a file). This could be really useful to have it backported in 1.2.x. ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

Remote code execution vulnerability in log4j 2.x
by Ceki Gülcü 10 Dec '21

10 Dec '21

Hello all, You might have heard of a Remote code execution (RCE) vulnerability in log4j 2.x, that allows an attacker to execute arbitrary code by controlling the contents of a single logged message. While vulnerabilities are reported now and then, this vulnerability is totally unheard of in its severity. As for logback, while logback claims to be the successor to log4j 1.x, logback is unrelated to log4j 2.x. It does not share code nor vulnerabilities with log4j 2.x. More specifically, logback does not suffer from aforementioned said RCE vulnerability in any shape or form. Unfortunately, the vulnerability exists under SLF4J API when log4j 2.x is used as the back-end implementation. Given the severity of this issue, we encourage you to consider logback as the preferred back-end for SLF4J API. Also note that logback performs significantly better than log4 2.x. Please see the benchmark results at: http://logback.qos.ch/performance.html Better yet, run the benchmark yourself. https://github.com/ceki/logback-perf In our opinion, logging libraries need to be reliable first and foremost with new features added only with extreme care. Best regards, Further references to the RCE vulnerability: https://www.lunasec.io/docs/blog/log4j-zero-day/ https://twitter.com/P0rZ9/status/1468949890571337731 https://github.com/apache/logging-log4j2/pull/608 -- Ceki Gülcü Please contact sales(a)qos.ch for support related to SLF4J or logback projects.

1 0

[qos-ch/logback] b810c1: disassociate logback from log4j 2.x as much as pos...
by Ceki Gulcu 10 Dec '21

10 Dec '21

Branch: refs/heads/master Home: https://github.com/qos-ch/logback Commit: b810c115e363081afc70f8bf4ee535318c3a34e1 https://github.com/qos-ch/logback/commit/b810c115e363081afc70f8bf4ee535318c… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-10 (Fri, 10 Dec 2021) Changed paths: M logback-site/src/site/pages/index.html M logback-site/src/site/pages/reasonsToSwitch.html Log Message: ----------- disassociate logback from log4j 2.x as much as possible Signed-off-by: Ceki Gulcu <ceki(a)qos.ch>

1 0

[qos-ch/logback] 5db099: disassociate logback from log4j 2.x as much as pos...
by Ceki Gulcu 10 Dec '21

10 Dec '21

Branch: refs/heads/master Home: https://github.com/qos-ch/logback Commit: 5db09939d97bc4a26670e37667ded1e5cf5c4505 https://github.com/qos-ch/logback/commit/5db09939d97bc4a26670e37667ded1e5cf… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-10 (Fri, 10 Dec 2021) Changed paths: M logback-site/src/site/pages/reasonsToSwitch.html Log Message: ----------- disassociate logback from log4j 2.x as much as possible Signed-off-by: Ceki Gulcu <ceki(a)qos.ch>

1 0

[qos-ch/logback] f7392b: disassociate logback from log4j 2.x as much as pos...
by Ceki Gulcu 10 Dec '21

10 Dec '21

Branch: refs/heads/master Home: https://github.com/qos-ch/logback Commit: f7392b4cfeac1d1ee7f370600dbd5ecc962a2287 https://github.com/qos-ch/logback/commit/f7392b4cfeac1d1ee7f370600dbd5ecc96… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-10 (Fri, 10 Dec 2021) Changed paths: M logback-site/src/site/pages/index.html Log Message: ----------- disassociate logback from log4j 2.x as much as possible Signed-off-by: Ceki Gulcu <ceki(a)qos.ch>

1 0