- slf4j-dev - mailman3.qos.ch

[JIRA] Updates for SLF4J-431: Mark EventData as deprecated in preparation for its removal
by QOS.CH (JIRA) 13 Jan '22

13 Jan '22

SLF4J / SLF4J-431 [Closed] Mark EventData as deprecated in preparation for its removal ============================== Here's what changed in this issue in the last few minutes. There is 1 comment. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-431 ============================== 1 comment ------------------------------ Neustradamus on 13/Jan/22 9:15 PM It has not been solved in 1.8.0-beta3 (no release), it has been solved in 1.8.0-beta4 and 1.7.26 (stable). Linked to: - https://jira.qos.ch/browse/SLF4J-455 ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-455: Missing 1.8.0 stable build, no CVEs patches... beta-2 not complete...
by QOS.CH (JIRA) 13 Jan '22

13 Jan '22

SLF4J / SLF4J-455 [Resolved] Missing 1.8.0 stable build, no CVEs patches... beta-2 not complete... ============================== Here's what changed in this issue in the last few minutes. There are 2 comments. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-455 ============================== 2 comments ------------------------------ Neustradamus on 13/Jan/22 9:09 PM @ceki: I know that 1.8-beta is now 2.0-alpha. CVE-2018-8088 has been fixed in 1.7.26 and 1.8.0-beta4 after my requests by e-mail, JIRA, and Twitter. But in the CVE-2018-8088 it is noted solved in 1.8.0-beta2 but it is NOT TRUE IT IS IN 1.8.0-beta4 and it has been solved in stable branch in 1.7.26, it is not specified: - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8088 - https://www.google.com/search?q=CVE-2018-8088 There is a problem in description of the CVE-2018-8088: ``` org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. ``` Time to request the update with reality the JIRA ticket number 455 and the CVE: - 1.8.0-beta4 - 1.7.26 JIRA: - https://jira.qos.ch/browse/SLF4J-455 - http://mailman.qos.ch/pipermail/slf4j-dev/2019-February/005118.html Your tickets about CVE but it has been solved in 1.8.0-beta4: https://www.slf4j.org/news.html There was not a 1.8.0-beta3! - Currently it is specified 1.8.0-beta3: https://jira.qos.ch/browse/SLF4J-430 - Currently it is specified 1.8.0-beta2: https://jira.qos.ch/browse/SLF4J-431 Mail: - http://mailman.qos.ch/pipermail/slf4j-user/2019-February/001700.html - http://mailman.qos.ch/pipermail/slf4j-dev/2019-February/005115.html Twitter: - https://twitter.com/neustradamus/status/1095041579780374529 - https://twitter.com/neustradamus/status/1098724924607393794 - https://twitter.com/neustradamus/status/1098725012494635008 - https://twitter.com/neustradamus/status/1411324627582963722 ------------------------------ Ceki Gülcü on 13/Jan/22 9:12 PM The issue has been solved in all live branches. What do you want to be done at this time? ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-430: Remove org.slf4j.ext.EventData due to security issue
by QOS.CH (JIRA) 13 Jan '22

13 Jan '22

SLF4J / SLF4J-430 [Closed] Remove org.slf4j.ext.EventData due to security issue ============================== Here's what changed in this issue in the last few minutes. There are 2 comments. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-430 ============================== 2 comments ------------------------------ Neustradamus on 13/Jan/22 9:12 PM It has been solved in 1.8.0-beta4, there was not 1.8.0-beta4 and 1.7.26 (stable). Linked to: - https://jira.qos.ch/browse/SLF4J-455 ------------------------------ Neustradamus on 13/Jan/22 9:15 PM Sorry, the good text is: It has not been solved in 1.8.0-beta3 (no release), it has been solved in 1.8.0-beta4 and 1.7.26 (stable). Linked to: - https://jira.qos.ch/browse/SLF4J-455 ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-455: Missing 1.8.0 stable build, no CVEs patches... beta-2 not complete...
by QOS.CH (JIRA) 13 Jan '22

13 Jan '22

SLF4J / SLF4J-455 [Resolved] Missing 1.8.0 stable build, no CVEs patches... beta-2 not complete... ============================== Here's what changed in this issue in the last few minutes. There are 2 updates, 1 comment. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-455 ============================== 2 updates ------------------------------ Changes by Ceki Gülcü on 13/Jan/22 7:24 PM Resolution: Fixed Status: Resolved (was: Open) ============================== 1 comment ------------------------------ Ceki Gülcü on 13/Jan/22 7:23 PM 2.0.0 has all the changes from 1.8.x. Thus, CVE-2018-8088 has been fixed both in the 2.0.0 and 1.7.x branches. ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

Release of SLF4J version 1.7.33
by Ceki Gülcü 13 Jan '22

13 Jan '22

Hello all, I am very happy to announce the immediate availability of SLF4J version 1.7.33. This release adds the "slf4j-reload4j" module which delegates logging processing to the reload4j logging framework. The reload4j project is a fork of Apache log4j version 1.2.17 with the goal of fixing pressing security issues. It is intended as a drop-in replacement for log4j version 1.2.17. By drop-in, we mean the replacement of log4j.jar with reload4j.jar in your build with no source code changes in .java files being necessary. Reload4j project web site: https://reload4j.qos.ch/ If you are using slf4j-log4j12 as your binding of choice, please consider using slf4j-reload4j instead. Please refer to the the news page for more details on this release: http://www.slf4j.org/news.html The relevant artifacts should hit the Maven central repository within the next few hours. The 1.7.x series: The Simple Logging Facade for Java or (SLF4J) serves as a simple facade or abstraction for various logging frameworks, e.g. java.util.logging, log4j 1.x, reload4j and logback, allowing the end user to plug in the desired logging framework at deployment time. Binary compatibility: Mixing mixing different versions of slf4j-api.jar and SLF4J binding can cause problems. For example, if you are using slf4j-api-1.7.1.jar, then you should also use slf4j-simple-1.7.1.jar, using slf4j-simple-1.5.5.jar will not work. >From the client's perspective all versions of slf4j-api are compatible. Client code compiled with slf4j-api-N.jar will run perfectly fine with slf4j-api-M.jar for any N and M. You only need to ensure that the version of your binding matches that of the slf4j-api.jar. You do not have to worry about the version of slf4j-api.jar used to compile a given dependency in your project. You can always use *any* version of slf4j-api.jar, and as long as the version of slf4j-api.jar and its binding match, you should be fine. Downloading SLF4J: You can download SLF4J, including full source code, class files and documentation from Maven central under the "org.slf4j" groupId. Announcement mailing list: You can receive SLF4J related announcements by subscribing to the SLF4J announce mailing list. To subscribe to QOS.ch announce list, please visit the following URL. http://www.qos.ch/mailman/listinfo/announce Donations and sponsorship You can also support SLF4J/logback/reload4j projects via donations and sponsorship. We thank our current supporters and sponsors for their continued contributions. https://github.com/sponsors/qos-ch Enjoy, -- Ceki Gülcü Please contact support(at)qos.ch for donations, sponsorship or support contracts related to SLF4J/logback/reload4j projects.

1 0

[JIRA] Updates for SLF4J-535: typo in SimpleLogger javadoc regarding threadId
by QOS.CH (JIRA) 13 Jan '22

13 Jan '22

SLF4J / SLF4J-535 [Resolved] typo in SimpleLogger javadoc regarding threadId ============================== Here's what changed in this issue in the last few minutes. This issue has been created There are 2 updates, 1 comment. This issue is now assigned to you. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-535 ============================== Issue created ------------------------------ JIRA Administrator created this issue on 13/Jan/22 4:15 PM Summary: typo in SimpleLogger javadoc regarding threadId Issue Type: Task Assignee: SLF4J developers list Created: 13/Jan/22 4:15 PM Priority: Minor Reporter: JIRA Administrator ============================== 2 updates ------------------------------ Changes by Ceki Gülcü on 13/Jan/22 4:23 PM Resolution: Fixed Status: Resolved (was: Open) ============================== 1 comment ------------------------------ Ceki Gülcü on 13/Jan/22 4:19 PM See https://github.com/qos-ch/slf4j/commit/60e70fbc83aebd2dc41c6b30386dce27445e… ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-372: plan for JDK 9/jigsaw
by QOS.CH (JIRA) 13 Jan '22

13 Jan '22

SLF4J / SLF4J-372 [Resolved] plan for JDK 9/jigsaw ============================== Here's what changed in this issue in the last few minutes. There are 2 updates. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-372 ============================== 2 updates ------------------------------ Changes by JIRA Administrator on 13/Jan/22 3:31 PM Resolution: Fixed Status: Resolved (was: Open) ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-499: Add property to log thread id
by QOS.CH (JIRA) 13 Jan '22

13 Jan '22

SLF4J / SLF4J-499 [Resolved] Add property to log thread id ============================== Here's what changed in this issue in the last few minutes. There are 2 updates. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-499 ============================== 2 updates ------------------------------ Changes by JIRA Administrator on 13/Jan/22 3:20 PM Resolution: Fixed Status: Resolved (was: In Progress) ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-534: Improve error handling for situations where paths is null in findPossibleStaticLoggerBinderPathSet()
by QOS.CH (JIRA) 12 Jan '22

12 Jan '22

SLF4J / SLF4J-534 [Open] Improve error handling for situations where paths is null in findPossibleStaticLoggerBinderPathSet() ============================== Here's what changed in this issue in the last few minutes. There is 1 comment. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-534 ============================== 1 comment ------------------------------ Oliver Lietz on 12/Jan/22 11:25 PM Happens also without Pax Logging: {noformat} Failed to instantiate SLF4J LoggerFactory Reported exception: java.lang.NullPointerException: Cannot invoke "java.util.Enumeration.hasMoreElements()" because "paths" is null at ModuleConnectLoader-org.slf4j/org.slf4j@1.7.32/org.slf4j.LoggerFactory.findPossibleStaticLoggerBinderPathSet(LoggerFactory.java:310) at ModuleConnectLoader-org.slf4j/org.slf4j@1.7.32/org.slf4j.LoggerFactory.bind(LoggerFactory.java:146) at ModuleConnectLoader-org.slf4j/org.slf4j@1.7.32/org.slf4j.LoggerFactory.performInitialization(LoggerFactory.java:124) at ModuleConnectLoader-org.slf4j/org.slf4j@1.7.32/org.slf4j.LoggerFactory.getILoggerFactory(LoggerFactory.java:417) at ModuleConnectLoader-org.slf4j/org.slf4j@1.7.32/org.slf4j.LoggerFactory.getLogger(LoggerFactory.java:362) at ModuleConnectLoader-org.slf4j/org.slf4j@1.7.32/org.slf4j.LoggerFactory.getLogger(LoggerFactory.java:388) at ModuleConnectLoader-handlebars/handlebars(a)4.3.0/com.github.jknack.handlebars.Handlebars.<clinit>(Handlebars.java:313) at ModuleConnectLoader-de.bildschirmarbeiter.aem.toolbox.application/de.bildschirmarbeiter.aem.toolbox.application@0.0.3.SNAPSHOT/de.bildschirmarbeiter.aem.toolbox.application.Activator.handlebars(Activator.java:37) at ModuleConnectLoader-de.bildschirmarbeiter.aem.toolbox.application/de.bildschirmarbeiter.aem.toolbox.application@0.0.3.SNAPSHOT/de.bildschirmarbeiter.aem.toolbox.application.Activator.start(Activator.java:22) at org.apache.felix.framework@7.0.3/org.apache.felix.framework.util.SecureAction.startActivator(SecureAction.java:849) at org.apache.felix.framework@7.0.3/org.apache.felix.framework.Felix.activateBundle(Felix.java:2429) at org.apache.felix.framework@7.0.3/org.apache.felix.framework.Felix.startBundle(Felix.java:2335) at org.apache.felix.framework@7.0.3/org.apache.felix.framework.Felix.setActiveStartLevel(Felix.java:1566) at org.apache.felix.framework@7.0.3/org.apache.felix.framework.FrameworkStartLevelImpl.run(FrameworkStartLevelImpl.java:308) at java.base/java.lang.Thread.run(Thread.java:833) {noformat} ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-499: Add property to log thread id
by QOS.CH (JIRA) 12 Jan '22

12 Jan '22

SLF4J / SLF4J-499 [In Progress] Add property to log thread id ============================== Here's what changed in this issue in the last few minutes. There is 1 comment. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-499 ============================== 1 comment ------------------------------ Ceki Gülcü on 12/Jan/22 10:48 PM My memory is coming back to me. :) ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0