December 2021 - slf4j-dev - mailman3.qos.ch

[qos-ch/slf4j] 71d5c0: typo fixes
by Ceki Gülcü 13 Dec '21

13 Dec '21

Branch: refs/heads/master Home: https://github.com/qos-ch/slf4j Commit: 71d5c081e8a386431bf5ad517153a99cd7c8b90e https://github.com/qos-ch/slf4j/commit/71d5c081e8a386431bf5ad517153a99cd7c8… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-13 (Mon, 13 Dec 2021) Changed paths: M log4j-over-slf4j/compatibility/readme.txt M slf4j-site/src/site/pages/legacy.html Log Message: ----------- typo fixes Signed-off-by: Ceki Gulcu <ceki(a)qos.ch> Commit: 53a9833a3cdac18aed9dab7a0e6894fa1c77edfb https://github.com/qos-ch/slf4j/commit/53a9833a3cdac18aed9dab7a0e6894fa1c77… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-13 (Mon, 13 Dec 2021) Changed paths: M slf4j-site/src/site/pages/log4shell.html Log Message: ----------- read only access Signed-off-by: Ceki Gulcu <ceki(a)qos.ch> Compare: https://github.com/qos-ch/slf4j/compare/81d57c271b25...53a9833a3cda

1 0

[qos-ch/slf4j] 81d57c: doc changes
by Ceki Gulcu 13 Dec '21

13 Dec '21

Branch: refs/heads/master Home: https://github.com/qos-ch/slf4j Commit: 81d57c271b25bcf24e8c3970fe49941477476540 https://github.com/qos-ch/slf4j/commit/81d57c271b25bcf24e8c3970fe4994147747… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-13 (Mon, 13 Dec 2021) Changed paths: M slf4j-site/src/site/pages/codes.html M slf4j-site/src/site/pages/extensions.html M slf4j-site/src/site/pages/faq.html M slf4j-site/src/site/pages/legacy.html M slf4j-site/src/site/pages/localization.html M slf4j-site/src/site/pages/manual.html M slf4j-site/src/site/pages/migrator.html Log Message: ----------- doc changes Signed-off-by: Ceki Gulcu <ceki(a)qos.ch>

1 0

[qos-ch/slf4j] 65524d: AS IS with no warranty
by Ceki Gulcu 13 Dec '21

13 Dec '21

Branch: refs/heads/master Home: https://github.com/qos-ch/slf4j Commit: 65524de79af27b4d73e130873c4feab88530be3c https://github.com/qos-ch/slf4j/commit/65524de79af27b4d73e130873c4feab88530… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-13 (Mon, 13 Dec 2021) Changed paths: M slf4j-site/src/site/pages/log4shell.html Log Message: ----------- AS IS with no warranty Signed-off-by: Ceki Gulcu <ceki(a)qos.ch>

1 0

[qos-ch/slf4j] 45fbb1: css improvements
by Ceki Gulcu 13 Dec '21

13 Dec '21

Branch: refs/heads/master Home: https://github.com/qos-ch/slf4j Commit: 45fbb1ebc86ebee42cbb1634801168d198947259 https://github.com/qos-ch/slf4j/commit/45fbb1ebc86ebee42cbb1634801168d19894… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-13 (Mon, 13 Dec 2021) Changed paths: M slf4j-site/src/site/pages/bug-reporting.html M slf4j-site/src/site/pages/css/site.css M slf4j-site/src/site/pages/docs.html M slf4j-site/src/site/pages/download.html M slf4j-site/src/site/pages/index.html M slf4j-site/src/site/pages/license.html M slf4j-site/src/site/pages/log4shell.html M slf4j-site/src/site/pages/mailing-lists.html M slf4j-site/src/site/pages/news.html Log Message: ----------- css improvements Signed-off-by: Ceki Gulcu <ceki(a)qos.ch>

1 0

[qos-ch/slf4j] 7a6867: updates to log4shell comments
by Ceki Gulcu 11 Dec '21

11 Dec '21

Branch: refs/heads/master Home: https://github.com/qos-ch/slf4j Commit: 7a68675fc6669473eac1a26ba15c0b93f18dabc5 https://github.com/qos-ch/slf4j/commit/7a68675fc6669473eac1a26ba15c0b93f18d… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-12 (Sun, 12 Dec 2021) Changed paths: M slf4j-site/src/site/pages/log4shell.html Log Message: ----------- updates to log4shell comments Signed-off-by: Ceki Gulcu <ceki(a)qos.ch>

1 0

[qos-ch/slf4j] 25ddfa: comments on CVE-2021-44228
by Ceki Gulcu 11 Dec '21

11 Dec '21

Branch: refs/heads/master Home: https://github.com/qos-ch/slf4j Commit: 25ddfaaab055a5ac813e77123590deca1329d6f3 https://github.com/qos-ch/slf4j/commit/25ddfaaab055a5ac813e77123590deca1329… Author: Ceki Gulcu <ceki(a)qos.ch> Date: 2021-12-11 (Sat, 11 Dec 2021) Changed paths: M slf4j-site/src/site/pages/docs.html A slf4j-site/src/site/pages/log4shell.html Log Message: ----------- comments on CVE-2021-44228 Signed-off-by: Ceki Gulcu <ceki(a)qos.ch>

1 0

Remote code execution vulnerability in log4j 2.x
by Ceki Gülcü 10 Dec '21

10 Dec '21

Hello all, You might have heard of a Remote code execution (RCE) vulnerability in log4j 2.x, that allows an attacker to execute arbitrary code by controlling the contents of a single logged message. While vulnerabilities are reported now and then, this vulnerability is totally unheard of in its severity. As for logback, while logback claims to be the successor to log4j 1.x, logback is unrelated to log4j 2.x. It does not share code nor vulnerabilities with log4j 2.x. More specifically, logback does not suffer from aforementioned said RCE vulnerability in any shape or form. Unfortunately, the vulnerability exists under SLF4J API when log4j 2.x is used as the back-end implementation. Given the severity of this issue, we encourage you to consider logback as the preferred back-end for SLF4J API. Also note that logback performs significantly better than log4 2.x. Please see the benchmark results at: http://logback.qos.ch/performance.html Better yet, run the benchmark yourself. https://github.com/ceki/logback-perf In our opinion, logging libraries need to be reliable first and foremost with new features added only with extreme care. Best regards, Further references to the RCE vulnerability: https://www.lunasec.io/docs/blog/log4j-zero-day/ https://twitter.com/P0rZ9/status/1468949890571337731 https://github.com/apache/logging-log4j2/pull/608 -- Ceki Gülcü Please contact sales(a)qos.ch for support related to SLF4J or logback projects.

3 3