- logback-dev - mailman3.qos.ch

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 16 Dec '21

16 Dec '21

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 16 Dec '21

16 Dec '21

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 16 Dec '21

16 Dec '21

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 16 Dec '21

16 Dec '21

1 0

[JIRA] Updates for LOGBACK-1593: sessionViaJNDI function of SMTPAppender may suffers from jndi injections
by QOS.CH (JIRA) 16 Dec '21

16 Dec '21

logback / LOGBACK-1593 [Open] sessionViaJNDI function of SMTPAppender may suffers from jndi injections ============================== Here's what changed in this issue in the last few minutes. This issue has been created This issue is now assigned to you. View or comment on issue using this link https://jira.qos.ch/browse/LOGBACK-1593 ============================== Issue created ------------------------------ Diggid created this issue on 16/Dec/21 6:49 AM Summary: sessionViaJNDI function of SMTPAppender may suffers from jndi injections Issue Type: Bug Assignee: Logback dev list Attachments: poc.pdf Components: logback-classic, logback-core Created: 16/Dec/21 6:49 AM Labels: smtpappender Priority: Critical Reporter: Diggid Description: Hello friend! Similar to [CVE-2021-4104|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4104] in logback's SMTPAppender, it is possible to override the configuration to enable sessionViaJNDI and specify jndiLocation as a malicious jndi server, leading to jndi injection and even RCE. more details in the attached pdf ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 16 Dec '21

16 Dec '21

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 16 Dec '21

16 Dec '21

1 0

[qos-ch/logback] 2c032e: more work on microseconds
by Ceki Gülcü 15 Dec '21

15 Dec '21

Branch: refs/heads/master Home: https://github.com/qos-ch/logback Commit: 2c032ed99954bd2d8b44765460af2234f99d4cbe https://github.com/qos-ch/logback/commit/2c032ed99954bd2d8b44765460af2234f9… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-16 (Thu, 16 Dec 2021) Changed paths: M logback-classic/src/test/java/ch/qos/logback/classic/PatternLayoutTest.java M logback-site/src/site/pages/manual/layouts.html Log Message: ----------- more work on microseconds Signed-off-by: Ceki Gulcu <ceki(a)qos.ch>

1 0

[qos-ch/logback] ca09c5: typo fix
by Ceki Gülcü 15 Dec '21

15 Dec '21

Branch: refs/heads/master Home: https://github.com/qos-ch/logback Commit: ca09c508b4d689a1654ed1fde787c7c0cf4b1255 https://github.com/qos-ch/logback/commit/ca09c508b4d689a1654ed1fde787c7c0cf… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-15 (Wed, 15 Dec 2021) Changed paths: M logback-site/src/site/pages/codes.html Log Message: ----------- typo fix Signed-off-by: Ceki Gulcu <ceki(a)qos.ch> Commit: 6468696734ae2b8662a69f248f888a79c1d9afc5 https://github.com/qos-ch/logback/commit/6468696734ae2b8662a69f248f888a79c1… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-15 (Wed, 15 Dec 2021) Changed paths: M logback-site/src/site/pages/news.html Log Message: ----------- minor changes to news Signed-off-by: Ceki Gulcu <ceki(a)qos.ch> Compare: https://github.com/qos-ch/logback/compare/ce43569b0ffc...6468696734ae

1 0

[qos-ch/logback] ce4356: added support for micro seconds in LoggingEvent
by Ceki Gülcü 15 Dec '21

15 Dec '21

Branch: refs/heads/master Home: https://github.com/qos-ch/logback Commit: ce43569b0ffcb9430fc71fd7100065b3c022c7b0 https://github.com/qos-ch/logback/commit/ce43569b0ffcb9430fc71fd7100065b3c0… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-15 (Wed, 15 Dec 2021) Changed paths: M logback-classic/src/main/java/ch/qos/logback/classic/PatternLayout.java A logback-classic/src/main/java/ch/qos/logback/classic/pattern/MicrosecondConverter.java M logback-classic/src/main/java/ch/qos/logback/classic/spi/ILoggingEvent.java M logback-classic/src/main/java/ch/qos/logback/classic/spi/LoggingEvent.java M logback-classic/src/test/java/ch/qos/logback/classic/PatternLayoutTest.java A logback-classic/src/test/java/ch/qos/logback/classic/pattern/MicrosecondConverterTest.java Log Message: ----------- added support for micro seconds in LoggingEvent Signed-off-by: Ceki Gulcu <ceki(a)qos.ch>

1 0