openSUSE-SU-2021:1613-1
Security update for logback
Kaynağa göre önem derecesi
Hiçbir kaynak CVSS puanı vermiyor.
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: SUSE.
Açıklama
This update for logback fixes the following issues: Upgrade to version 1.2.8 + In response to log4Shell/CVE-2021-44228, all JNDI lookup code in logback has been disabled until further notice. This impacts ContextJNDISelector and insertFromJNDI element in configuration files. + Also in response to log4Shell/CVE-2021-44228, all database (JDBC) related code in the project has been removed with no replacement. + Note that the vulnerability mentioned in LOGBACK-1591 requires write access to logback's configuration file as a prerequisite. The log4Shell/CVE-2021-44228 and LOGBACK-1591 are of different severity levels. A successful RCE requires all of the following conditions to be met: - write access to logback.xml - use of versions lower then 1.2.8 - reloading of poisoned configuration data, which implies application restart or scan='true' set prior to attack This update was imported from the SUSE:SLE-15-SP2:Update update project.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| openSUSE Leap 15.2 | logback, logback-access, logback-examples ve 1 tane daha | 1.2.8-lp152.2.3.2 |
1 kaynaktaki 4 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| openSUSE Leap 15.2 | logback | 1.2.8-lp152.2.3.2 |
| openSUSE Leap 15.2 | logback-access | 1.2.8-lp152.2.3.2 |
| openSUSE Leap 15.2 | logback-examples | 1.2.8-lp152.2.3.2 |
| openSUSE Leap 15.2 | logback-javadoc | 1.2.8-lp152.2.3.2 |