- reload4j - mailman3.qos.ch

PR #26
by Ceki Gülcü 20 Jan '22

20 Jan '22

Hi Vladimir, FYI, just started studying PR 26 now. -- Ceki Gülcü Sponsoring SLF4J/logback/reload4j at https://github.com/sponsors/qos-ch

1 0

Release of reload4j version 1.2.18.1
by Ceki Gülcü 19 Jan '22

19 Jan '22

Hello all, I am very happy to announce the immediate availability of reload4j version 1.2.18.1. It is intended as a drop-in replacement for log4j version 1.2.17. By drop in, we mean the replacement of log4j.jar with reload4j.jar in your build with no source code changes in .java files being necessary. Reload4j has the following Maven coordinates: <dependency> <groupId>ch.qos.reload4j</groupId> <artifactId>reload4j</artifactId> <version>1.2.18.1</version> </dependency> Reload4j was built using Java 8 but targets Java 1.5. Version 1.2.8.0 and 1.2.18.1 correct the following issues: The unit tests were updated but no actual code was changed except for the removal of NTEventAppender and the correction of the following issues: - Standardize and sanitize the build - CVE-2021-4104 (JMSAppender) - fixed in 1.2.18.0 by hardening - CVE-2022-23302 (JMSSink) - fixed in 1.2.18.1 by hardening - CVE-2019-17571 (SocketServer) - fixed in 1.2.18.0 by hardening - CVE-2020-9493 CVE-2022-23307 (Chainsaw) - fixed in 1.2.18.1 by hardening - CVE-2022-23305 (JDBCAppender) - fixed in 1.2.18.1 by *removal* - broken MDC in newer JDKs - fixed in 1.2.18.0 In the absence of a robust and well tested countermeasure, JDBCAppender has been removed to prevent SQL injection attacks. We have a proposed countermeasure which may yet salvage JDBCAppender. https://github.com/qos-ch/reload4j/pull/26 Project web-site: https://reload4j.qos.ch/ Source repository: https://github.com/qos-ch/reload4j With release 1.2.18.0 and 1.2.18.1 we have addressed the most pressing issues regarding log4j 1.x vulnerabilities. As both log4j 1.x and reload4j do *not* offer a message lookup mechanism, they did not suffer from the notorious log4shell vulnerability. Donations and sponsorship You can also support SLF4J/logback/reload4j projects via donations and sponsorship. We thank our current supporters and sponsors for their continued contributions. Sponsorship link: https://github.com/sponsors/qos-ch?o=esb Announcement mailing list: You can receive SLF4J/logback/reload4j related announcements by subscribing QOS.ch announce list, please visit the following URL. http://www.qos.ch/mailman/listinfo/announce Enjoy, -- Ceki Gülcü

1 0

SQL injection problem in JDBCAppender
by Ceki Gülcü 19 Jan '22

19 Jan '22

Hi All, JDBCAppender uses simple strings instead of java.sql.Statement to talk to the database. This creates a vulnerability point for SQL injection attacks. Fixing this vulnerability in JDBCAppender (a rarely used component) in a backward compatible way would be a lot of work for very little or no benefit. S such, I propose to remove JDBCAppender from reload4j with no replacement. Any objections? -- Ceki Gülcü Sponsoring SLF4J/logback/reload4j at https://github.com/sponsors/qos-ch

3 9

state of reload4j
by Ceki Gülcü 19 Jan '22

19 Jan '22

Hello all, Except the SQL injection vulnerabilities in JDBCAppender (see , all known CVEs against log4j 1.x, including the recent ones, have been fixed in git. As I write this, Vladimir is working to fix JDBCAppender. -- Ceki Gülcü Sponsoring SLF4J/logback/reload4j at https://github.com/sponsors/qos-ch

1 0

Indentation issues
by Ceki Gülcü 15 Jan '22

15 Jan '22

Hello all, In order to facilitate collaboration, I propose to use the Java formatting convention as proposed by Eclipse as the "javaConvention". According to my initial investigation, Intellij IDEA's implementation of the default formatting scheme differs from that offered by the Eclipse default quite a bit. I copied the relevant javaConventions.xml file into the reload4j repository [1]. The good news is that Intellij can import javaConventions.xml without trouble. The bad news is that Intellij's and Eclipse's interpretation of this formatting specification differ slightly. Fortunately, the difference relates to Javadoc text and stabilizes after a while. By stabilizes, I mean that formatting in Eclipse and Intellij converge into something which does not change even after repeated formatting by one or the other tools. Comments welcome. [1] https://github.com/qos-ch/reload4j/blob/branch_1.2.18/javaConventions.xml -- Ceki Gülcü Sponsoring SLF4J/logback/reload4j at https://github.com/sponsors/qos-ch

2 1

PR12 https://github.com/qos-ch/reload4j/pull/12
by Ceki Gülcü 14 Jan '22

14 Jan '22

Hi Vlardimir, Thank you for PR 12 https://github.com/qos-ch/reload4j/pull/12 I am coming from afar and had not heard of Github Actions previously. However, I am somewhat familiar with Travis and its predecessor (name?). Anyway, I am looking into this PR now and will provide feedback. Please be indulgent as I might say stupid things in the process. -- Ceki Gülcü Please contact support(at)qos.ch for donations, sponsorship or support contracts related to SLF4J/logback/reload4j projects.

2 9

Use GitHub issues instead of JIRA
by Vladimir Sitnikov 13 Jan '22

13 Jan '22

Hi, What do you think of using https://github.com/qos-ch/reload4j/issues for issue management? I guess it would lower the barrier and it would be fewer context switches between GitHub and JIRA. There are only 6 issues, we can copy them manually, and close JIRA (or make it read-only) Vladimir

2 1

Release of reload4j version 1.2.8.0
by Ceki Gülcü 12 Jan '22

12 Jan '22

Hello all, I am very happy to announce the immediate availability of reload4j version 1.2.8.0. It is intended as a drop-in replacement for log4j version 1.2.17. By drop in, we mean the replacement of log4j.jar with reload4j.jar in your build with no source code changes in .java files being necessary. Reload4j has the following Maven coordinates: <dependency> <groupId>ch.qos.reload4j</groupId> <artifactId>reload4j</artifactId> <version>1.2.18.0</version> </dependency> Reload4j was built using Java 8 but targets Java 1.5. Version 1.2.8.0 corrects the following issues: The unit tests were updated but no actual code was changed except for the removal of NTEventAppender and the correction of the following issues: [REL-1] Standardize and sanitize project folder structure [REL-2] CVE-2021-4104 (JMSAppender vulnerability) [REL-3] CVE-2019-17571 (de-serialization vulnerability in SocketServer aka CVE-2019-17571) [REL-4] MDC breakage in newer JDKs Project web-site: https://reload4j.qos.ch/ Source repository: https://github.com/qos-ch/reload4j Jira: https://jira.qos.ch/ With release 1.2.8.0 we have addressed the most pressing issues regarding log4j 1.x vulnerabilities. Donations and sponsorship You can also support SLF4J/logback/reload4j projects via donations and sponsorship. We thank our current supporters and sponsors for their continued contributions. Sponsorship link: https://github.com/sponsors/qos-ch?o=esb Announcement mailing list: You can receive SLF4J/logback/reload4j related announcements by subscribing QOS.ch announce list, please visit the following URL. http://www.qos.ch/mailman/listinfo/announce Enjoy, -- Ceki Gülcü

2 1

State of the build - take II
by Ceki Gülcü 11 Jan '22

11 Jan '22

Hello all, I am happy to report that the reload4j build is now "releasable". By "releasable", I mean that it could be released to Maven central if so desired. The code is available at https://github.com/qos-ch/reload4j It can be built with Maven using JDK 8* and targets/runs under JDK 1.5. ** Tried with 1.8.0_121-b13 All tests pass. The tests were updated but no actual code was changed except for the removal of NTEventAppender and fixing REL-4. [REL-1] Standardize and sanitize project structure: Done [REL-2] CVE-2021-4104 (JMSAppender vulnerability): Fixed [REL-3] CVE-2019-17571 (de-serialization vulnerability in SocketServer aka CVE-2019-17571): Will be done tomorrow [REL-4] Fix MDC in newer JDKs: done [REL-1] https://jira.qos.ch/browse/REL-1 [REL-2] https://jira.qos.ch/browse/REL-2 [REL-3] https://jira.qos.ch/browse/REL-3 [REL-4] https://jira.qos.ch/browse/REL-4 Please try the build and kindly provide feedback. -- Ceki Gülcü Please contact suppport(at)qos.ch for donations, sponsorship or support contracts related to SLF4J or logback projects.

1 0

State of the build
by Ceki Gülcü 11 Jan '22

11 Jan '22

Hello all, I am happy to report that the reload4j build is now "releasable". By "releasable", I mean that it could be released to Maven central if so desired. The code is available at https://github.com/qos-ch/reload4j It can be built with Maven using JDK 1.7 and targets/runs under JDK 1.5. All tests pass. The tests were updated but no actual code was changed except for the removal of NTEventAppender. I have made a dry-run for a release. This fails with JDK 1.7 and requires JDK 1.8. I was not able to find the cause. Please try the build and provide feedback. -- Ceki Gülcü Please contact suppport(at)qos.ch for donations, sponsorship or support contracts related to SLF4J or logback projects.

1 1