[MNEMONIC-720] Security vulnerabilities of logback modules identified

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.17.0
• Fix Version/s: 0.17.0
• Component/s: Logging
• Assignee: Yanhui Zhao
• Reporter: Gordon King
• Due: 11/Feb/22
• Created: 08/Feb/22 07:33
• Updated: 06/Mar/22 01:31
• Resolved: 06/Mar/22 01:31

Description

There are several security vulnerabilities identified for the current version of logback modules

logback-core:

Direct vulnerabilities:
CVE-2021-42550
CVE-2017-5929

https://mvnrepository.com/artifact/ch.qos.logback/logback-core/1.1.11

logback-classic:

Direct vulnerabilities:
CVE-2017-5929

Vulnerabilities from dependencies:
CVE-2022-23305
CVE-2022-23302
CVE-2022-23221
CVE-2021-42550
CVE-2021-4104
CVE-2020-10683
CVE-2019-17571
CVE-2017-5929

https://mvnrepository.com/artifact/ch.qos.logback/logback-classic/1.1.11

Suggest upgrading to v1.2.10 to mitigate those risks.

 

Issue Links

• links to: GitHub Pull Request #269