February 2019 - slf4j-dev - mailman3.qos.ch

[JIRA] (SLF4J-454) Your project qos-ch/slf4j is using buggy third-party libraries [WARNING]
by QOS.CH (JIRA) 16 Feb '19

16 Feb '19

[ https://jira.qos.ch/browse/SLF4J-454?page=com.atlassian.jira.plugin.system.… ] Ceki Gülcü reopened SLF4J-454: ------------------------------ > Your project qos-ch/slf4j is using buggy third-party libraries [WARNING] > ------------------------------------------------------------------------ > > Key: SLF4J-454 > URL: https://jira.qos.ch/browse/SLF4J-454 > Project: SLF4J > Issue Type: Bug > Environment: Hi, there! > We are a research team working on third-party library analysis. We have found that some widely-used third-party libraries in your project have major/critical bugs, which will degrade the quality of your project. We highly recommend you to update those libraries to new versions. > We have attached the buggy third-party libraries and corresponding jira issue links below for you to have more detailed information. > 1. commons-lang commons-lang > version: 2.4 > Jira issues: > Fix case-insensitive string handling > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-432?filter=allopen… > StringEscapeUtils.escapeHTML() does not escape chars (0x00-0x20) > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-439?filter=allopen… > DateUtils.round doesn't work correct for Calendar.AM_PM > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-440?filter=allopen… > Lower Ascii Characters don't get encoded by Entities.java > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-448?filter=allopen… > Issue in HashCodeBuilder which only shows up under high load multi-threaded usage. > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-459?filter=allopen… > Ant build file does not include ReflectTestSuite > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-463?filter=allopen… > EqualsBuilder and HashCodeBuilder treat java.math.BigDecimal inconsistantly and break general contract of hashCode > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-467?filter=allopen… > JDK 1.5 build/runtime failure on LANG-393 (EqualsBuilder) > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-468?filter=allopen… > ExtendedMessageFormat: OutOfMemory with custom format registry and a pattern containing single quotes > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-477?filter=allopen… > parseDate cannot parse ISO8601 dates produced by FastDateFormat > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-530?filter=allopen… > DateFormatUtils.format does not correctly change Calendar TimeZone in certain situations > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-538?filter=allopen… > StringUtils replaceEach - Bug or Missing Documentation > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-552?filter=allopen… > Javadoc wrong for StringUtils startsWith; startsWithIgnoreCase; endsWith and endsWithIgnoreCase > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-557?filter=allopen… > HashCodeBuilder reflectionAppend creates unnecessary copy of excludeFields > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-575?filter=allopen… > ExceptionUtils uses mutable lock target > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-584?filter=allopen… > ClassUtils.toClass(Object[]) throws NPE on null array element > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-587?filter=allopen… > > Sincerely~ > FDU Software Engineering Lab > Feb 15th, 2019 > Reporter: Kaifeng Huang > Assignee: SLF4J developers list > Fix For: 1.8.0-beta4 > > -- This message was sent by Atlassian JIRA (v7.3.1#73012)

1 0

[JIRA] (SLF4J-454) Your project qos-ch/slf4j is using buggy third-party libraries [WARNING]
by QOS.CH (JIRA) 16 Feb '19

16 Feb '19

[ https://jira.qos.ch/browse/SLF4J-454?page=com.atlassian.jira.plugin.system.… ] Ceki Gülcü resolved SLF4J-454. ------------------------------ Resolution: Fixed Fixed by removing EventData EventException EventLogger classes in the org.slf4j.ext package in the slf4j-ext module. These classes were rarely used. > Your project qos-ch/slf4j is using buggy third-party libraries [WARNING] > ------------------------------------------------------------------------ > > Key: SLF4J-454 > URL: https://jira.qos.ch/browse/SLF4J-454 > Project: SLF4J > Issue Type: Bug > Environment: Hi, there! > We are a research team working on third-party library analysis. We have found that some widely-used third-party libraries in your project have major/critical bugs, which will degrade the quality of your project. We highly recommend you to update those libraries to new versions. > We have attached the buggy third-party libraries and corresponding jira issue links below for you to have more detailed information. > 1. commons-lang commons-lang > version: 2.4 > Jira issues: > Fix case-insensitive string handling > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-432?filter=allopen… > StringEscapeUtils.escapeHTML() does not escape chars (0x00-0x20) > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-439?filter=allopen… > DateUtils.round doesn't work correct for Calendar.AM_PM > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-440?filter=allopen… > Lower Ascii Characters don't get encoded by Entities.java > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-448?filter=allopen… > Issue in HashCodeBuilder which only shows up under high load multi-threaded usage. > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-459?filter=allopen… > Ant build file does not include ReflectTestSuite > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-463?filter=allopen… > EqualsBuilder and HashCodeBuilder treat java.math.BigDecimal inconsistantly and break general contract of hashCode > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-467?filter=allopen… > JDK 1.5 build/runtime failure on LANG-393 (EqualsBuilder) > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-468?filter=allopen… > ExtendedMessageFormat: OutOfMemory with custom format registry and a pattern containing single quotes > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-477?filter=allopen… > parseDate cannot parse ISO8601 dates produced by FastDateFormat > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-530?filter=allopen… > DateFormatUtils.format does not correctly change Calendar TimeZone in certain situations > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-538?filter=allopen… > StringUtils replaceEach - Bug or Missing Documentation > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-552?filter=allopen… > Javadoc wrong for StringUtils startsWith; startsWithIgnoreCase; endsWith and endsWithIgnoreCase > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-557?filter=allopen… > HashCodeBuilder reflectionAppend creates unnecessary copy of excludeFields > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-575?filter=allopen… > ExceptionUtils uses mutable lock target > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-584?filter=allopen… > ClassUtils.toClass(Object[]) throws NPE on null array element > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-587?filter=allopen… > > Sincerely~ > FDU Software Engineering Lab > Feb 15th, 2019 > Reporter: Kaifeng Huang > Assignee: SLF4J developers list > Fix For: 1.7.26, 1.8.0-beta3 > > -- This message was sent by Atlassian JIRA (v7.3.1#73012)

1 0

[JIRA] (SLF4J-455) Missing 1.8.0 stable build, no CVEs patches... beta-2 not complete...
by QOS.CH (JIRA) 16 Feb '19

16 Feb '19

Neustradamus created SLF4J-455: ---------------------------------- Summary: Missing 1.8.0 stable build, no CVEs patches... beta-2 not complete... Key: SLF4J-455 URL: https://jira.qos.ch/browse/SLF4J-455 Project: SLF4J Issue Type: Bug Components: Core API, slf4j-ext Affects Versions: 1.8.0-beta2, 1.7.25, 1.8.0-beta3 Environment: all Reporter: Neustradamus Assignee: SLF4J developers list There are CVEs but no stable version with patchs. There is a 1.8.0-beta2 which is not perfect (2018-03-21) and a 1.8.0-beta3 not published. -> [http://mailman.qos.ch/pipermail/slf4j-user/2019-February/001700.html] -> [http://mailman.qos.ch/pipermail/slf4j-dev/2019-February/005115.html] A lot of softwares use slf4j 1.7.25 but not with CVEs patchs because no new stable version, why? Can you release a stable version with CVEs patches? Soon one year after... -- This message was sent by Atlassian JIRA (v7.3.1#73012)

1 0

[JIRA] (SLF4J-454) Your project qos-ch/slf4j is using buggy third-party libraries [WARNING]
by QOS.CH (JIRA) 15 Feb '19

15 Feb '19

Kaifeng Huang created SLF4J-454: ----------------------------------- Summary: Your project qos-ch/slf4j is using buggy third-party libraries [WARNING] Key: SLF4J-454 URL: https://jira.qos.ch/browse/SLF4J-454 Project: SLF4J Issue Type: Bug Environment: Hi, there! We are a research team working on third-party library analysis. We have found that some widely-used third-party libraries in your project have major/critical bugs, which will degrade the quality of your project. We highly recommend you to update those libraries to new versions. We have attached the buggy third-party libraries and corresponding jira issue links below for you to have more detailed information. 1. commons-lang commons-lang version: 2.4 Jira issues: Fix case-insensitive string handling affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-432?filter=allopen… StringEscapeUtils.escapeHTML() does not escape chars (0x00-0x20) affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-439?filter=allopen… DateUtils.round doesn't work correct for Calendar.AM_PM affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-440?filter=allopen… Lower Ascii Characters don't get encoded by Entities.java affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-448?filter=allopen… Issue in HashCodeBuilder which only shows up under high load multi-threaded usage. affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-459?filter=allopen… Ant build file does not include ReflectTestSuite affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-463?filter=allopen… EqualsBuilder and HashCodeBuilder treat java.math.BigDecimal inconsistantly and break general contract of hashCode affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-467?filter=allopen… JDK 1.5 build/runtime failure on LANG-393 (EqualsBuilder) affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-468?filter=allopen… ExtendedMessageFormat: OutOfMemory with custom format registry and a pattern containing single quotes affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-477?filter=allopen… parseDate cannot parse ISO8601 dates produced by FastDateFormat affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-530?filter=allopen… DateFormatUtils.format does not correctly change Calendar TimeZone in certain situations affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-538?filter=allopen… StringUtils replaceEach - Bug or Missing Documentation affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-552?filter=allopen… Javadoc wrong for StringUtils startsWith; startsWithIgnoreCase; endsWith and endsWithIgnoreCase affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-557?filter=allopen… HashCodeBuilder reflectionAppend creates unnecessary copy of excludeFields affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-575?filter=allopen… ExceptionUtils uses mutable lock target affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-584?filter=allopen… ClassUtils.toClass(Object[]) throws NPE on null array element affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-587?filter=allopen… Sincerely~ FDU Software Engineering Lab Feb 15th, 2019 Reporter: Kaifeng Huang Assignee: SLF4J developers list -- This message was sent by Atlassian JIRA (v7.3.1#73012)

2 1

SLF4J CVE stable solution
by - Neustradamus - 11 Feb '19

11 Feb '19

Dear all, It is possible to have an official stable 1.8.0 of slf4j with CVEs solution? -> https://www.cvedetails.com/vulnerability-list/vendor_id-17827/Slf4j.html There is only a beta2 from one year... -> https://www.slf4j.org/news.html -> https://www.slf4j.org/download.html -> https://github.com/qos-ch/slf4j/releases And there is a problem: Softwares do not used unstable builds. Thanks in advance. Regards, Neustradamus

1 0

[JIRA] (SLF4J-451) org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data.
by QOS.CH (JIRA) 05 Feb '19

05 Feb '19

[ https://jira.qos.ch/browse/SLF4J-451?page=com.atlassian.jira.plugin.system.… ] Kevin Wilson commented on SLF4J-451: ------------------------------------ >> It is irrelevent whether the vulnerability is really neither critical nor severe. Agreed!!! Very nice account as to why this bug should be fixed and soon! Also, the primary maintainers need to include vulnerability scanning in their build pipeline to catch things like this before they are committed. The open source tools to have your code scanned on every build exists and are quite good, you simply have to use them. > org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. > ------------------------------------------------------------------------------------------------------------------------------------------------------------------- > > Key: SLF4J-451 > URL: https://jira.qos.ch/browse/SLF4J-451 > Project: SLF4J > Issue Type: Bug > Components: slf4j-ext > Affects Versions: 1.8.0-beta2 > Environment: Linux > Reporter: Narayan > Assignee: SLF4J developers list > Labels: logging > > More details is available in [https://nvd.nist.gov/vuln/detail/CVE-2018-8088|https://nvd.nist.gov/vuln/de…] -- This message was sent by Atlassian JIRA (v7.3.1#73012)

1 0

[JIRA] (SLF4J-451) org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data.
by QOS.CH (JIRA) 05 Feb '19

05 Feb '19

[ https://jira.qos.ch/browse/SLF4J-451?page=com.atlassian.jira.plugin.system.… ] Mark Symons commented on SLF4J-451: ----------------------------------- > The vulnerability is actually not critical and not even severe. It is irrelevent whether the vulnerability is really neither critical nor severe. The CVE states that it is. * That means that vulnerability scanning tools will report this. * Thus, managers will demand explanation. * Even worse, customers who follow [OWASP Component Analysis|https://www.owasp.org/index.php/Component_Analysis] recommendations (specifically, "Contractually require BOMs from vendors") will demand explanation. > org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. > ------------------------------------------------------------------------------------------------------------------------------------------------------------------- > > Key: SLF4J-451 > URL: https://jira.qos.ch/browse/SLF4J-451 > Project: SLF4J > Issue Type: Bug > Components: slf4j-ext > Affects Versions: 1.8.0-beta2 > Environment: Linux > Reporter: Narayan > Assignee: SLF4J developers list > Labels: logging > > More details is available in [https://nvd.nist.gov/vuln/detail/CVE-2018-8088|https://nvd.nist.gov/vuln/de…] -- This message was sent by Atlassian JIRA (v7.3.1#73012)

1 0

[JIRA] (SLF4J-451) org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data.
by QOS.CH (JIRA) 04 Feb '19

04 Feb '19

[ https://jira.qos.ch/browse/SLF4J-451?page=com.atlassian.jira.plugin.system.… ] Ceki Gülcü commented on SLF4J-451: ---------------------------------- The vulnerability is actually not severe. > org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. > ------------------------------------------------------------------------------------------------------------------------------------------------------------------- > > Key: SLF4J-451 > URL: https://jira.qos.ch/browse/SLF4J-451 > Project: SLF4J > Issue Type: Bug > Components: slf4j-ext > Affects Versions: 1.8.0-beta2 > Environment: Linux > Reporter: Narayan > Assignee: SLF4J developers list > Labels: logging > > More details is available in [https://nvd.nist.gov/vuln/detail/CVE-2018-8088|https://nvd.nist.gov/vuln/de…] -- This message was sent by Atlassian JIRA (v7.3.1#73012)

1 0

[JIRA] (SLF4J-453) Amazon Aws Certification Exam Downloads
by QOS.CH (JIRA) 04 Feb '19

04 Feb '19

[ https://jira.qos.ch/browse/SLF4J-453?page=com.atlassian.jira.plugin.system.… ] JIRA Administrator deleted SLF4J-453: ------------------------------------- > Amazon Aws Certification Exam Downloads > --------------------------------------- > > Key: SLF4J-453 > URL: https://jira.qos.ch/browse/SLF4J-453 > Project: SLF4J > Issue Type: Bug > Environment: Amazon Aws Certification Exam Downloads > Reporter: Emma Stone > Assignee: SLF4J developers list > Priority: Minor > > Amazon Aws Certification Exam Downloads -- This message was sent by Atlassian JIRA (v7.3.1#73012)

1 0

[JIRA] (SLF4J-453) Amazon Aws Certification Exam Downloads
by QOS.CH (JIRA) 04 Feb '19

04 Feb '19

Emma Stone created SLF4J-453: -------------------------------- Summary: Amazon Aws Certification Exam Downloads Key: SLF4J-453 URL: https://jira.qos.ch/browse/SLF4J-453 Project: SLF4J Issue Type: Bug Environment: Amazon Aws Certification Exam Downloads Reporter: Emma Stone Assignee: SLF4J developers list Priority: Minor Attachments: 1Z0-160.pdf, 210-250.pdf, 210-255.pdf, 300-160.pdf, 300-375.pdf, 312-38.pdf, 3314.pdf, 400-351.pdf, 70-480.pdf, 70-483.pdf, ACP-100.pdf, ACP-200.pdf, AWS-002.pdf, AWS-003.pdf, AWS-004-Demo.pdf, AWS-004.pdf, AWS-005.pdf, AWS-006-New.pdf, AWS-006.pdf, AWS-007.pdf, AWS-007.pdf, AWS-008.pdf, BPS-On.pdf, BPS-PH.pdf, CAT-223-Demo.pdf, CCEP-I.pdf, CCP.pdf, CCSP.pdf, CFPS.pdf, CISM.pdf, CISSP.pdf, CKA.pdf, CLTD.pdf, CMRP.pdf, COA-01.pdf, CS0-001.pdf, CSCP.pdf, CSX-F-Demo.pdf, CTP.pdf, DNDNS-200.pdf, NetSuiteFoundation-Demo.pdf, NS0-001.pdf, PMI.pdf, SCOR-P.pdf, SY0-501.pdf Amazon Aws Certification Exam Downloads -- This message was sent by Atlassian JIRA (v7.3.1#73012)

1 0