From ce15e71dd890061915f36277df2716e626f9ea70 Mon Sep 17 00:00:00 2001 From: Ceki Gulcu Date: Wed, 15 Dec 2021 08:51:26 +0100 Subject: [PATCH] less drama --- pom.xml | 1 + slf4j-api/pom.xml | 1 + slf4j-api/src/main/java9/module-info.java | 1 + slf4j-site/src/site/pages/bug-reporting.html | 4 ++-- slf4j-site/src/site/pages/css/site.css | 2 +- slf4j-site/src/site/pages/log4shell.html | 11 +++++++---- slf4j-site/src/site/pages/news.html | 2 +- slf4j-site/src/site/pages/templates/left.js | 2 +- 8 files changed, 15 insertions(+), 9 deletions(-) diff --git a/pom.xml b/pom.xml index c23dc3371..404065d3c 100755 --- a/pom.xml +++ b/pom.xml @@ -217,6 +217,7 @@ maven-jar-plugin ${maven-jar-plugin.version} + default-jar package diff --git a/slf4j-api/pom.xml b/slf4j-api/pom.xml index 5a4ffa2a1..47d70a6da 100755 --- a/slf4j-api/pom.xml +++ b/slf4j-api/pom.xml @@ -41,6 +41,7 @@ org.apache.maven.plugins maven-jar-plugin + ${maven-jar-plugin.version} bundle-test-jar diff --git a/slf4j-api/src/main/java9/module-info.java b/slf4j-api/src/main/java9/module-info.java index dd7cd8e73..96f08f29e 100755 --- a/slf4j-api/src/main/java9/module-info.java +++ b/slf4j-api/src/main/java9/module-info.java @@ -4,4 +4,5 @@ exports org.slf4j.event; exports org.slf4j.helpers; uses org.slf4j.spi.SLF4JServiceProvider; +requires java.base; } diff --git a/slf4j-site/src/site/pages/bug-reporting.html b/slf4j-site/src/site/pages/bug-reporting.html index 1d68968de..3a5682824 100755 --- a/slf4j-site/src/site/pages/bug-reporting.html +++ b/slf4j-site/src/site/pages/bug-reporting.html @@ -10,10 +10,10 @@ - -
+ +
diff --git a/slf4j-site/src/site/pages/css/site.css b/slf4j-site/src/site/pages/css/site.css index 8d4cfc66b..235b8d252 100755 --- a/slf4j-site/src/site/pages/css/site.css +++ b/slf4j-site/src/site/pages/css/site.css @@ -38,7 +38,7 @@ a { #container { margin-left: auto; margin-right: auto; - max-width: 100em; + max-width: 90em; } diff --git a/slf4j-site/src/site/pages/log4shell.html b/slf4j-site/src/site/pages/log4shell.html index 08473375e..fdd9d63f8 100644 --- a/slf4j-site/src/site/pages/log4shell.html +++ b/slf4j-site/src/site/pages/log4shell.html @@ -96,9 +96,9 @@

Is log4j 1.x vulnerable?

configuration file will typically only become effective at application restart.

-

Nevertheless, while not easy, such an attack is - feasible. Thus it makes sense to make job of the attacker harder - by removing JMSAppender altogether from +

Nevertheless, while not easy, such an attack is not + impossible. Thus it makes some sense to make job of the attacker + even harder by removing JMSAppender altogether from log4j-1.2.17.jar.

In the absence of a new log4j 1.x release, you can remove @@ -144,7 +144,7 @@

Does a similar vulnerability exist in logback?

However, logback may make JNDI calls from within its configuration file. This was recently + href="https://jira.qos.ch/browse/LOGBACK-1591">recently reported as a vulnerability of lesser severity. In response, we have released logback version 1.2.8. Please upgrade. @@ -168,6 +168,9 @@

Does a similar vulnerability exist in logback?

upgrading to logback version 1.2.8, we also recommend users to deploy their logback configuration files as read-only.

+

If you have read thus far, you + probably understand that log4Shell/CVE-2021-44228 and + LOGBACK-1591 are of different severity levels.

Additional protective measure: write protect log4j{1,2}/logback configuration diff --git a/slf4j-site/src/site/pages/news.html b/slf4j-site/src/site/pages/news.html index 210ae8d62..1f790a3d2 100755 --- a/slf4j-site/src/site/pages/news.html +++ b/slf4j-site/src/site/pages/news.html @@ -13,7 +13,7 @@ -
+
diff --git a/slf4j-site/src/site/pages/templates/left.js b/slf4j-site/src/site/pages/templates/left.js index d90da2648..81df72293 100755 --- a/slf4j-site/src/site/pages/templates/left.js +++ b/slf4j-site/src/site/pages/templates/left.js @@ -5,7 +5,7 @@ document.write(' Download'); document.write(' Documentation'); document.write(' License'); document.write(' News'); - +document.write(' log4shell'); document.write('

Support

'); document.write(' Mailing Lists');