- logback-dev - mailman3.qos.ch

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 14 Dec '21

14 Dec '21

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 14 Dec '21

14 Dec '21

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 14 Dec '21

14 Dec '21

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 14 Dec '21

14 Dec '21

1 0

SECURITY FIX - Release of logback version 1.2.8 with security Fixes
by Ceki Gülcü 14 Dec '21

14 Dec '21

== Includes security fixes ==== Hello all, In the wake of CVE-2021-44228, a serialization related vulnerability has been reported which affects logback. In response to this vulnerability we have disabled all JNDI lookup code in logback until further notice. This impacts ContextJNDISelector and <insertFromJNDI> element in configuration files. We have also removed all database (JDBC) related code in the project with no replacement. We note that the vulnerability mentioned in LOGBACK-1591 [1] requires write access to logback's configuration file as a prerequisite. An demo of the vulnerability can be found at [2]. We urge you to upgrade to logback 1.2.8 as soon as possible. A release on the 1.3.x branch will follow shorty. As an additional precautionary measure, we also recommend users to set their configuration files as read-only. Best regards, [1] https://jira.qos.ch/browse/LOGBACK-1591 [2] https://github.com/cn-panda/logbackRceDemo -- Ceki Gülcü Please contact sales(at)qos.ch for support related to SLF4J or logback projects.

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 14 Dec '21

14 Dec '21

1 0

[qos-ch/logback] 119847: prepare release 1.2.8
by Ceki Gülcü 14 Dec '21

14 Dec '21

Branch: refs/heads/branch_1.2.x Home: https://github.com/qos-ch/logback Commit: 119847d9c3efb854d48ae208d6c848492f4024dc https://github.com/qos-ch/logback/commit/119847d9c3efb854d48ae208d6c848492f… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-14 (Tue, 14 Dec 2021) Changed paths: M logback-access/pom.xml M logback-classic/pom.xml M logback-core/pom.xml M logback-examples/pom.xml M logback-site/pom.xml M pom.xml Log Message: ----------- prepare release 1.2.8 Signed-off-by: Ceki Gulcu <ceki(a)qos.ch>

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 14 Dec '21

14 Dec '21

1 0

[qos-ch/logback] 21d772: LOGBACK-1591
by Ceki Gülcü 14 Dec '21

14 Dec '21

Branch: refs/heads/branch_1.2.x Home: https://github.com/qos-ch/logback Commit: 21d772f2bc2ed780b01b4fe108df7e29707763f1 https://github.com/qos-ch/logback/commit/21d772f2bc2ed780b01b4fe108df7e2970… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-14 (Tue, 14 Dec 2021) Changed paths: R logback-access/src/main/java/ch/qos/logback/access/db/DBAppender.java R logback-access/src/main/java/ch/qos/logback/access/db/package.html M logback-access/src/test/java/ch/qos/logback/access/AllAccessTest.java R logback-access/src/test/java/ch/qos/logback/access/db/DBAppenderHSQLTest.java R logback-access/src/test/java/ch/qos/logback/access/db/DBAppenderHSQLTestFixture.java R logback-access/src/test/java/ch/qos/logback/access/db/DBAppenderIntegrationTest.java R logback-access/src/test/java/ch/qos/logback/access/db/PackageTest.java R logback-classic/src/main/java/ch/qos/logback/classic/db/DBAppender.java R logback-classic/src/main/java/ch/qos/logback/classic/db/DBHelper.java R logback-classic/src/main/java/ch/qos/logback/classic/db/SQLBuilder.java R logback-classic/src/main/java/ch/qos/logback/classic/db/package.html M logback-classic/src/main/java/ch/qos/logback/classic/selector/ContextJNDISelector.java M logback-classic/src/main/java/ch/qos/logback/classic/selector/servlet/ContextDetachingSCL.java M logback-classic/src/main/java/ch/qos/logback/classic/util/JNDIUtil.java M logback-classic/src/test/java/ch/qos/logback/classic/AllClassicTest.java R logback-classic/src/test/java/ch/qos/logback/classic/db/DBAppenderH2Test.java R logback-classic/src/test/java/ch/qos/logback/classic/db/DBAppenderH2TestFixture.java R logback-classic/src/test/java/ch/qos/logback/classic/db/DBAppenderHSQLTest.java R logback-classic/src/test/java/ch/qos/logback/classic/db/DBAppenderHSQLTestFixture.java R logback-classic/src/test/java/ch/qos/logback/classic/db/DBAppenderIntegrationTest.java R logback-classic/src/test/java/ch/qos/logback/classic/db/PackageTest.java R logback-classic/src/test/java/ch/qos/logback/classic/db/SQLBuilderTest.java R logback-classic/src/test/java/ch/qos/logback/classic/db/names/DefaultDBNameResolverTest.java R logback-classic/src/test/java/ch/qos/logback/classic/db/names/PackageTest.java R logback-classic/src/test/java/ch/qos/logback/classic/db/names/SimpleDBNameResolverTest.java M logback-classic/src/test/java/ch/qos/logback/classic/selector/ContextDetachingSCLTest.java M logback-classic/src/test/java/ch/qos/logback/classic/selector/ContextJNDISelectorTest.java R logback-core/src/main/java/ch/qos/logback/core/db/BindDataSourceToJNDIAction.java R logback-core/src/main/java/ch/qos/logback/core/db/ConnectionSource.java R logback-core/src/main/java/ch/qos/logback/core/db/ConnectionSourceBase.java R logback-core/src/main/java/ch/qos/logback/core/db/DBAppenderBase.java R logback-core/src/main/java/ch/qos/logback/core/db/DBHelper.java R logback-core/src/main/java/ch/qos/logback/core/db/DataSourceConnectionSource.java R logback-core/src/main/java/ch/qos/logback/core/db/DriverManagerConnectionSource.java R logback-core/src/main/java/ch/qos/logback/core/db/JNDIConnectionSource.java R logback-core/src/main/java/ch/qos/logback/core/db/dialect/DBUtil.java R logback-core/src/main/java/ch/qos/logback/core/db/dialect/H2Dialect.java R logback-core/src/main/java/ch/qos/logback/core/db/dialect/HSQLDBDialect.java R logback-core/src/main/java/ch/qos/logback/core/db/dialect/MsSQLDialect.java R logback-core/src/main/java/ch/qos/logback/core/db/dialect/MySQLDialect.java R logback-core/src/main/java/ch/qos/logback/core/db/dialect/OracleDialect.java R logback-core/src/main/java/ch/qos/logback/core/db/dialect/PostgreSQLDialect.java R logback-core/src/main/java/ch/qos/logback/core/db/dialect/SQLDialect.java R logback-core/src/main/java/ch/qos/logback/core/db/dialect/SQLDialectCode.java R logback-core/src/main/java/ch/qos/logback/core/db/dialect/SQLiteDialect.java R logback-core/src/main/java/ch/qos/logback/core/db/dialect/SybaseSqlAnywhereDialect.java R logback-core/src/main/java/ch/qos/logback/core/db/dialect/package.html R logback-core/src/main/java/ch/qos/logback/core/db/package.html Log Message: ----------- LOGBACK-1591 Signed-off-by: Ceki Gulcu <ceki(a)qos.ch>

1 0

[JIRA] (LOGBACK-1591) Possibility of vulnerability
by QOS.CH (JIRA) 14 Dec '21

14 Dec '21

1 0