openSUSE-SU-2021:4109-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2021:4109-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2021:4109-1
Related
Published
2021-12-17T08:40:59Z
Modified
2021-12-17T08:40:59Z
Summary
Security update for logback
Details

This update for logback fixes the following issues:

Upgrade to version 1.2.8

  • In response to log4Shell/CVE-2021-44228, all JNDI lookup code in logback has been disabled until further notice. This impacts ContextJNDISelector and insertFromJNDI element in configuration files.
  • Also in response to log4Shell/CVE-2021-44228, all database (JDBC) related code in the project has been removed with no replacement.
  • Note that the vulnerability mentioned in LOGBACK-1591 requires write access to logback's configuration file as a prerequisite. The log4Shell/CVE-2021-44228 and LOGBACK-1591 are of different severity levels. A successful RCE requires all of the following conditions to be met:
    • write access to logback.xml
    • use of versions lower then 1.2.8
    • reloading of poisoned configuration data, which implies application restart or scan='true' set prior to attack
References

Affected packages

openSUSE:Leap 15.3 / logback

Package

Name
logback
Purl
purl:rpm/suse/logback&distro=openSUSE%20Leap%2015.3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.8-3.3.1

Ecosystem specific 

{
    "binaries": [
        {
            "logback-examples": "1.2.8-3.3.1",
            "logback": "1.2.8-3.3.1",
            "logback-access": "1.2.8-3.3.1",
            "logback-javadoc": "1.2.8-3.3.1"
        }
    ]
}