Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update Logback to 1.3.14 #353

Merged
merged 2 commits into from
Dec 7, 2023
Merged

Update Logback to 1.3.14 #353

merged 2 commits into from
Dec 7, 2023

Conversation

kelvinqian00
Copy link
Collaborator

@kelvinqian00 kelvinqian00 commented Dec 7, 2023 •
edited
Loading

Update Logback to 1.3.14 to address CVE-2023-6481. Note that the underlying vulnerability was actually fixed in the previous update, but we still need to update for a more complete fix. From the Logback website:

More complete fix for CVE-2023-6378 both for the 1.4.x series and the 1.3.x series...In order to encourage users to upgrade to versions 1.3.14/1.4.14 CVE-2023-6481 has been created even though the underlying vulnerability for both CVE records is identical.

In addition, we update the config variable name maxLifetime to poolMaxLifetime in the documentation, to address a naming oversight from the last update.

@kelvinqian00 kelvinqian00 marked this pull request as ready for review December 7, 2023 14:36
@kelvinqian00 kelvinqian00 requested a review from milt December 7, 2023 14:37
@kelvinqian00 kelvinqian00 merged commit 8e7939d into main Dec 7, 2023
@kelvinqian00 kelvinqian00 deleted the logback_1.3.14 branch December 7, 2023 14:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@milt milt milt approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@kelvinqian00 @milt