[MNG-7441] Update Version of (optional) Logback to Address CVE-2021-42550

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.8.5
• Fix Version/s: 3.8.6, 3.9.0, 4.0.0-alpha-2, 4.0.0
• Component/s: Dependencies
• Assignee: Tamas Cservenak
• Reporter: Mac Hale
• Created: 24/Mar/22 22:07
• Updated: 20/Oct/22 08:11
• Resolved: 08/Apr/22 07:44

Description

CVE-2021-42550 is present in Logback versions 1.2.7 and earlier. Maven (optionally) uses v 1.2.1. Please update to Logback 1.2.9, which includes a fix as per [https://jira.qos.ch/browse/LOGBACK-1591|https://jira.qos.ch/browse/LOGBACK-1591.]

I see ch.qos.logback 1.2.1 in ./pom.xml and ch.qos.logback without a version specified in ./maven-embedder/pom.xml

But I'm no expert on this code base so it's possible there are other versioned references.

Edit: One could argue, as the Logback team has done, that the CVE is unimportant since in order to exploit it one must already have compromised the system. However, security scanners pick this up as an issue, causing unnecessary work and justifications.

Issue Links

• relates to: MNG-5375 Document use of SLF4J
• links to: GitHub Pull Request #708