You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@zookeeper.apache.org by "anmolnar (via GitHub)" <gi...@apache.org> on 2025/08/01 22:37:01 UTC
[PR] ZOOKEEPER-4891. Update logback to 1.3.15 to fix CVE-2024-12798. (branch-3.9) [zookeeper]
anmolnar opened a new pull request, #2290:
URL: https://github.com/apache/zookeeper/pull/2290
Attempt to upgrade logback and slf4j on branch-3.9
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ZOOKEEPER-4891. Update logback to 1.3.15 to fix CVE-2024-12798. (branch-3.9) [zookeeper]
Posted by "anmolnar (via GitHub)" <gi...@apache.org>.
anmolnar commented on PR #2290:
URL: https://github.com/apache/zookeeper/pull/2290#issuecomment-3168902287
I'll merge this patch to `branch-3.9` only in order to resolve the security issues related to logback, but not backporting it to `branch-3.8`. With 3.8 we have other options that we can discuss in the mailing list. We could either replace **logback** with a simpler implementation like `slf4j-simple` or just remove the **logback** artifact complete or EoL the 3.8.x release line and create 3.10.x releases.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ZOOKEEPER-4891. Update logback to 1.3.15 to fix CVE-2024-12798. (branch-3.9) [zookeeper]
Posted by "ctubbsii (via GitHub)" <gi...@apache.org>.
ctubbsii commented on PR #2290:
URL: https://github.com/apache/zookeeper/pull/2290#issuecomment-3145955665
My concern was based on the potential incompatibility and potential breakage for existing users using the older series of logging dependencies. I think users can mitigate this by making their own decisions in their deployments about which logging dependencies to use at runtime. Ultimately, users are responsible for their own class paths. Any particular application can only make a best effort approach at a particular point in time when releasing, but those decisions can quickly become out of date after release, so it's users who decide what's on a deployed system. As such, I don't think these warnings are very useful to users, and upstream devs in ZK should only take them as advisories. I would just ignore the OWASP checks during the build, and not make it a release blocker, since upstream logback and slf4j don't have updates for these versions. Then, just advise users to consider newer logging dependencies, or a newer version of ZK.
In short, 1) check if there's a compatible update to these versions upstream, 2) if not, suppress the build error and include a note in the release notes to advise users.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ZOOKEEPER-4891. Update logback to 1.3.15 to fix CVE-2024-12798. (branch-3.9) [zookeeper]
Posted by "anmolnar (via GitHub)" <gi...@apache.org>.
anmolnar commented on PR #2290:
URL: https://github.com/apache/zookeeper/pull/2290#issuecomment-3145935170
@ctubbsii I see you've raised concerns in #2162 about doing this change in branches other than the `master`. Do you have any idea what to do instead to suspend failing OWASP reports? Shall we just add another Owasp supression for logback?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ZOOKEEPER-4891. Update logback to 1.3.15 to fix CVE-2024-12798. (branch-3.9) [zookeeper]
Posted by "phunt (via GitHub)" <gi...@apache.org>.
phunt commented on PR #2290:
URL: https://github.com/apache/zookeeper/pull/2290#issuecomment-3168882983
+1 lgtm.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ZOOKEEPER-4891. Update logback to 1.3.15 to fix CVE-2024-12798. (branch-3.9) [zookeeper]
Posted by "anmolnar (via GitHub)" <gi...@apache.org>.
anmolnar merged PR #2290:
URL: https://github.com/apache/zookeeper/pull/2290
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org