[KARAF-7299] Review logback CVE-2021-42550 for impact to karaf

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 4.2.12, 4.3.3
• Component/s: karaf
• Assignee: Jean-Baptiste Onofré
• Reporter: Matt Pavlovich
• Created: 17/Dec/21 15:16
• Updated: 19/Dec/21 06:26
• Resolved: 19/Dec/21 06:26

Description

Logback CVE-2021-42550 along the lines of Log4Shell.

logback fixed in v1.2.9

Notes:

1. Karaf does not install logback bundle from pax-logging by default
2. there is no feature to install pax-logging-logback
3. Users must manually enable logback

ref: https://jira.qos.ch/browse/LOGBACK-1591

Issue Links

• is duplicated by: KARAF-7300 Upgrade to Pax Logging 2.0.13