openSUSE-SU-2021:4109-1
Security update for logback
Einstufung nach Quelle
Keine Quelle nennt einen CVSS-Wert.
Trivys eigenes Label ist CRITICAL. Kritisch laut SUSE.
Beschreibung
This update for logback fixes the following issues: Upgrade to version 1.2.8 + In response to log4Shell/CVE-2021-44228, all JNDI lookup code in logback has been disabled until further notice. This impacts ContextJNDISelector and insertFromJNDI element in configuration files. + Also in response to log4Shell/CVE-2021-44228, all database (JDBC) related code in the project has been removed with no replacement. + Note that the vulnerability mentioned in LOGBACK-1591 requires write access to logback's configuration file as a prerequisite. The log4Shell/CVE-2021-44228 and LOGBACK-1591 are of different severity levels. A successful RCE requires all of the following conditions to be met: - write access to logback.xml - use of versions lower then 1.2.8 - reloading of poisoned configuration data, which implies application restart or scan='true' set prior to attack
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| openSUSE Leap 15.3 | logback, logback-access, logback-examples und 1 weitere | 1.2.8-3.3.1 |
Alle 4 Einträge aus 1 Quelle zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| openSUSE Leap 15.3 | logback | 1.2.8-3.3.1 |
| openSUSE Leap 15.3 | logback-access | 1.2.8-3.3.1 |
| openSUSE Leap 15.3 | logback-examples | 1.2.8-3.3.1 |
| openSUSE Leap 15.3 | logback-javadoc | 1.2.8-3.3.1 |