Project

General

Profile

Actions
Copy link

Bug #20421

closed

Upgrade logback version for LOGBACK-1591 / JNDI

Added by François ARMAND almost 3 years ago. Updated almost 3 years ago.

Status:
Released
Priority:
N/A
Assignee:
Alexis Mousset
Category:
Security
Target version:
6.1.18
Pull Request:
https://github.com/Normation/rudder/p...
Severity:
UX impact:
User visibility:
Effort required:
Priority:
0
Name check:
To do
Fix check:
Checked
Regression:

Description

After log4j JNDI vulnerability, logback did an audit of their code and found a potential, low risk (since it needs write access to logback.xml file) vector:
https://jira.qos.ch/browse/LOGBACK-1591.

The /opt/rudder/etc/logback.xml should only be writeable by the root user on Rudder servers, so it does not seem exploitable.

We still should update to logback 2.6.8 in case other, more horrible, attack vectors are found.

Actions
Copy link
 #1

Updated by François ARMAND almost 3 years ago

  • Status changed from New to In progress
  • Assignee set to François ARMAND
Actions
Copy link
 #2

Updated by Alexis Mousset almost 3 years ago

  • Description updated (diff)
Actions
Copy link
 #3

Updated by François ARMAND almost 3 years ago

  • Status changed from In progress to Pending technical review
  • Assignee changed from François ARMAND to Alexis Mousset
  • Pull Request set to https://github.com/Normation/rudder/pull/4051
Actions
Copy link
 #4

Updated by Alexis Mousset almost 3 years ago

  • Description updated (diff)
Actions
Copy link
 #5

Updated by François ARMAND almost 3 years ago

  • Status changed from Pending technical review to Pending release
Actions
Copy link
 #6

Updated by Alexis Mousset almost 3 years ago

  • Fix check changed from To do to Checked
Actions
Copy link
 #7

Updated by Vincent MEMBRÉ almost 3 years ago

  • Status changed from Pending release to Released

This bug has been fixed in Rudder 6.1.18, 6.2.12 and 7.0.0~rc2 which were released today.

Actions
Copy link

Also available in: Atom PDF