December 2021 - logback-user

smtpappender broken in 1.2.9
by Chris Cheshire 24 Dec '21

24 Dec '21

Hi, I upgraded logback to 1.2.9 (from 1.2.3) in my webapp (running under tomcat) and now my SMTPAppender configuration is not working. I have file appenders configured too, but they are all working. Relevant config from logback.xml : <property name="SERVER_NAME" value="XXX" /> <property name="CONTEXT_PATH" value="XXX" /> <property name="LOG_DIR" value="${catalina.base}/logs/${CONTEXT_PATH}" scope="system" /> <appender name="email" class="ch.qos.logback.classic.net.SMTPAppender"> <sessionViaJNDI>true</sessionViaJNDI> <jndiLocation>java:comp/env/mail/XXX</jndiLocation> <to>XXX</to> <from>XXX</from> <subject>XXX</subject> <layout class="ch.qos.logback.classic.PatternLayout"> <pattern>%date{HH:mm:ss.SSS} [%thread] [%level] %logger#%line %n%n%mdc%n%message%n</pattern> </layout> <cyclicBufferTracker class="ch.qos.logback.core.spi.CyclicBufferTracker"> <bufferSize>1</bufferSize> </cyclicBufferTracker> <includeCallerData>true</includeCallerData> </appender> Relevant resource definition in context.xml <Resource name="mail/XXX" auth="Container" type="javax.mail.Session" mail.transport.protocol="smtps" mail.smtp.starttls.enable="true" mail.smtp.host="XXX" mail.smtp.port="587" /> Found in tomcat's default log: 23:51:33,656 |-INFO in ch.qos.logback.core.joran.action.AppenderAction - About to instantiate appender of type [ch.qos.logback.classic.net.SMTPAppender] 23:51:33,669 |-INFO in ch.qos.logback.core.joran.action.AppenderAction - Naming appender as [email] 23:51:33,711 |-INFO in ch.qos.logback.classic.net.SMTPAppender[email] - Looking up javax.mail.Session at JNDI location [java:comp/env/mail/XXX] 23:51:33,720 |-ERROR in ch.qos.logback.classic.net.SMTPAppender[email] - Failed to obtain javax.mail.Session from JNDI location [java:comp/env/mail/XXX] 23:51:33,720 |-ERROR in ch.qos.logback.classic.net.SMTPAppender[email] - Failed to obtain javax.mail.Session. Cannot start. Nothing else was changed, I just uploaded the new jars and restarted tomcat and now it fails. Downgraded to 1.2.7 and SMTPAppender works again.

2 4

Differences between logback 1.2.8 and 1.2.9
by Arjohn Kampman 17 Dec '21

17 Dec '21

Hi, First of all: thank you for looking into the vulnerabilities related to the log4j news. The announcement about the 1.2.9 release is a bit light on details in how it differs from the 1.2.8 release. I thought the 1.2.8 disabled all the critical bits, which makes it safe to use again, but the news article indicates that any version prior to 1.2.9 (including 1.2.8) is vulnerable. So does this mean that 1.2.9 fixes yet more security issues, or is this more about re-enabling some things that have been disabled in 1.2.8? Regards, Arjohn Kampman

2 4

Security Fix - logback 1.2.9 and 1.3.0-alpha11
by Ceki Gülcü 17 Dec '21

17 Dec '21

Hello all, Since the publication of log4shell attack, a vulnerability of lesser importance has been reported against logback, namely CVE-2021-42550. See https://cve.report/CVE-2021-42550 for a description. See https://github.com/cn-panda/logbackRceDemo for a demo of the attack. In response, we have made several changes in logback components as to harden them. We have also dropped Groovy configuration support with no replacement. Please refer to the news page for more details. http://logback.qos.ch/news.html Even if the vulnerability found in logback is less threatening, we highly recommend that you upgrade to logback version 1.2.9 if you are on the 1.2.x series and to version 1.3.0-alpha11 if you are already on 1.3.x series. Best regards, -- Ceki Gülcü Please contact suppport(at)qos.ch for donations, sponsorship or support contracts related to SLF4J or logback projects.

1 0

SECURITY FIX - Release of logback version 1.2.8 with security Fixes
by Ceki Gülcü 14 Dec '21

14 Dec '21

== Includes security fixes ==== Hello all, In the wake of CVE-2021-44228, a serialization related vulnerability has been reported which affects logback. In response to this vulnerability we have disabled all JNDI lookup code in logback until further notice. This impacts ContextJNDISelector and <insertFromJNDI> element in configuration files. We have also removed all database (JDBC) related code in the project with no replacement. We note that the vulnerability mentioned in LOGBACK-1591 [1] requires write access to logback's configuration file as a prerequisite. An demo of the vulnerability can be found at [2]. We urge you to upgrade to logback 1.2.8 as soon as possible. A release on the 1.3.x branch will follow shorty. As an additional precautionary measure, we also recommend users to set their configuration files as read-only. Best regards, [1] https://jira.qos.ch/browse/LOGBACK-1591 [2] https://github.com/cn-panda/logbackRceDemo -- Ceki Gülcü Please contact sales(at)qos.ch for support related to SLF4J or logback projects.

1 0

Log4j Shell zero day vulnerability - does it affect logback or slf4j
by Deepak Abraham 13 Dec '21

13 Dec '21

Hello, Just wanted to check if the log4j vulnerability mentioned here: https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/12/log4j-ze… Has any equivalent exploit in logback or slf4j users that: - Don't use log4j as a direct dependency- Bridge any log4j calls with org.slf4j:log4j-over-slf4j bridge jar Regards,Deepak.

3 2