[CASSANDRA-17204] Upgrade to Logback 1.2.9 (security)

• Type: Improvement
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 3.0.26, 3.11.12, 4.0.2, 4.1-alpha1, 4.1
• Component/s: Dependencies
• Change Category: Operability
• Complexity: Low Hanging Fruit
• Platform: All

Source Control Link

https://github.com/apache/cassandra/commit/28004d9c602bff1d6e3d8551c8cd53538578a8bb

Test and Documentation Plan

run CI

• Assignee: Brandon Williams Assign to me
• Reporter: Jochen Schalanda

Authors

Brandon Williams

Reviewers

Berenguer Blasi

• Created: 14/Dec/21 15:24
• Updated: 01/Nov/22 20:09
• Resolved: 20/Jan/22 15:52

Description

Logback 1.2.8 has been released with a fix for a potential vulnerability in its JNDI lookup.

• http://logback.qos.ch/news.html
• https://jira.qos.ch/browse/LOGBACK-1591

14th of December, 2021, Release of version 1.2.8
We note that the vulnerability mentioned in LOGBACK-1591 requires write access to logback's configuration file as a prerequisite.

• • In response to LOGBACK-1591, we have disabled all JNDI lookup code in logback until further notice. This impacts ContextJNDISelector and <insertFromJNDI> element in configuration files.
• Also in response to LOGBACK-1591, we have removed all database (JDBC) related code in the project with no replacement.

We note that the vulnerability mentioned in LOGBACK-1591 requires write access to logback's configuration file as a prerequisite. A successful RCE requires all of the following to be true:

• write access to logback.xml
• use of versions < 1.2.8
• reloading of poisoned configuration data, which implies application restart or scan="true" set prior to attack

Therefore and as an additional precaution, in addition to upgrading to version 1.2.8, we also recommend users to set their logback configuration files as read-only.

This is not as bad as CVE-2021-44228 in Log4j <2.15.0 (Log4Shell), but should probably be fixed anyway.

Issue Links

• causes: CASSANDRA-18002 Update NetBeans project file for dependency changes since 7th July 2021