diff --git a/slf4j-site/src/site/pages/index.html b/slf4j-site/src/site/pages/index.html index a6456d6b..6bceaa32 100755 --- a/slf4j-site/src/site/pages/index.html +++ b/slf4j-site/src/site/pages/index.html @@ -25,7 +25,7 @@
-

Simple Logging Facade for Java (SLF4J)

+

Simple Logging Facade for Java (SLF4J)

The Simple Logging Facade for Java (SLF4J) serves as a simple facade or abstraction for various logging frameworks @@ -39,8 +39,8 @@

Note that SLF4J-enabling your library implies the addition of only a single mandatory dependency, namely slf4j-api.jar. - If no binding is found on the class path, then SLF4J will default to - a no-operation implementation. + If no binding/provider is found on the class path, then SLF4J will + default to a no-operation implementation.

In case you wish to migrate your Java source files to SLF4J, diff --git a/slf4j-site/src/site/pages/log4shell.html b/slf4j-site/src/site/pages/log4shell.html index fdd9d63f..c14c35dc 100644 --- a/slf4j-site/src/site/pages/log4shell.html +++ b/slf4j-site/src/site/pages/log4shell.html @@ -28,22 +28,23 @@

-

Comments on the CVE-2021-44228 vulnerability

+

Comments on the log4shell(CVE-2021-44228) vulnerability

Preamble

-

The JNDI/LDAP/RMI/X serialization rabbit hole runs deep and - leads to much uncertainty. Thus, the contents of this page - are the result of our current knowledge and are provided AS IS - without warranty of any kind.

- +

The contents of this page are the result of our + understanding of the situation and are provided AS IS without + warranty of any kind.

+ +

What is CVE-2021-44228?

-

CVE-2021-44228 is a vulnerability classified under the - highest severity mark, i.e. 10 out of 10. It allows an attacker - to execute arbitrary code by injecting attacker-controlled data - into a logged message. As far as vulnerabilities are concerned, - CVE-2021-44228 is probably as bad as it gets. +

CVE-2021-44228 + is a vulnerability classified under the highest severity mark, + i.e. 10 out of 10. It allows an attacker to execute arbitrary + code by injecting attacker-controlled data into a logged + message. As far as vulnerabilities are concerned, CVE-2021-44228 + is probably as bad as it gets.

Superlatives aside, it is important to understand the -

Log4j 2.x is open for this attack because it performs a - lookup, aka string substitution, using the JNDI protocol, - whenever the "${jndi:...}" string is found - within a message parameter. As mentioned above, the contents of - the message parameter can be injected quite easily by the - attacker.

+

Log4j version 2.15 and earlier are open for this attack + because it performs a lookup, aka string substitution, using the + JNDI protocol, whenever the "${jndi:...}" + string is found within a message parameter. As mentioned above, + the contents of the message parameter can be injected quite + easily by the attacker.

Is log4j 1.x vulnerable?

@@ -143,11 +144,12 @@ with respect to CVE-2021-44228.

However, logback may make JNDI calls from within its - configuration file. This was recently - reported as a vulnerability of lesser severity. In response, we have released - logback version 1.2.8. Please upgrade. + configuration file. This was recently reported + in CVE-2021-42550 + (aka LOGBACK-1591) + as a vulnerability of lesser + severity. In response, we have released logback version + 1.2.9. Please upgrade.

Note that the vulnerability affecting logback requires write @@ -159,18 +161,23 @@

  1. attacker has write access to logback.xml
    2. -
  2. use of logback version older than 1.2.8
    3. +
  3. use of logback version older than 1.2.9
  4. loading of poisoned configuration data, which implies application restart or scan="true" set prior to attack

As a belt-and-suspenders type of precaution, in addition to - upgrading to logback version 1.2.8, we also recommend users to + upgrading to logback version 1.2.9, we also recommend users to deploy their logback configuration files as read-only.

-

If you have read thus far, you - probably understand that log4Shell/CVE-2021-44228 and - LOGBACK-1591 are of different severity levels.

+

More details about the contents latest logback releases can + be found in the logback + news page. + +

If you have read thus far, you probably + understand that log4Shell/CVE-2021-44228 and + LOGBACK-1591/CVE-2021-42550 are of different severity + levels.

Additional protective measure: write protect log4j{1,2}/logback configuration @@ -211,10 +218,116 @@ owner. If possible, they should also be monitored against changes and unauthorized manipulation.

- +

Prevalence of logging + frameworks

+ +

As discussed above, while log4j 2.14 and earlier are + vulnerable to log4shell, log4j 1.x and logback are not.

+ +

At this stage, it might be useful mention the prevalence of + each logging library in order to put things into + perspective. Here are the relevant figures as found + in mvnrepository site + on 2021-12-17.

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ProjectCategorygroup:artifactusageCountpercentage
SLF4JAPIorg.slf4j:slf4j-api52,24769%
Commons-loggingAPIcommons-logging:commons-logging10,41214%
SLF4JAPIorg.slf4j:jcl-over-slf4j7,54610%
LOG4J2APIorg.apache.logging.log4j:log4j-api5,226 7%
TotalAPI -45,174 100%
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ProjectCategorygroup:artifactusageCountpercentage
LOGBACKimplementationch.qos.logback:logback-classic21,77048%
LOG4J1implementationlog4j:log4j16,61037%
LOG4J2implementationorg.apache.logging.log4j:log4j-core6,97415%
Totalimplementaion -45,174 100%
+ +

Notwithstanding its 48% prevalence overall (implementation), + no attacks have been reported against logback that we are aware + of.

+

Further reading

    +
  1. Log4j 2 - The Ghost in the logging framework from (2019)
  2. Log4Shell: RCE 0-day exploit found in log4j2, a popular Java logging @@ -222,7 +335,8 @@
  3. lunasec-io/lunasec
    4. - + +
  4. Security in context: When is a CVE not a CVE?
diff --git a/slf4j-site/src/site/pages/scpSLF4J b/slf4j-site/src/site/pages/scpSLF4J new file mode 100644 index 00000000..e69de29b diff --git a/slf4j-site/src/site/pages/templates/header.js b/slf4j-site/src/site/pages/templates/header.js index 35f75bc9..d992e746 100644 --- a/slf4j-site/src/site/pages/templates/header.js +++ b/slf4j-site/src/site/pages/templates/header.js @@ -1,12 +1,25 @@ +document.write(''); diff --git a/slf4j-site/src/site/resources/images/GitHub-Mark-32px.png b/slf4j-site/src/site/resources/images/GitHub-Mark-32px.png new file mode 100644 index 00000000..8b25551a Binary files /dev/null and b/slf4j-site/src/site/resources/images/GitHub-Mark-32px.png differ diff --git a/slf4j-site/src/site/resources/images/TwitterLogo_blue.svg b/slf4j-site/src/site/resources/images/TwitterLogo_blue.svg new file mode 100644 index 00000000..b25ac935 --- /dev/null +++ b/slf4j-site/src/site/resources/images/TwitterLogo_blue.svg @@ -0,0 +1,16 @@ + + +