[From nobody Sun Sep 13 04:35:06 2026
Received: (at submit) by bugs.debian.org; 23 Dec 2024 19:45:11 +0000
X-Spam-Checker-Version: SpamAssassin 3.4.6-bugs.debian.org_2005_01_02
 (2021-04-09) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-9.6 required=4.0 tests=BAYES_00,FROMDEVELOPER,
 KHOP_HELO_FCRDNS,MD5_SHA1_SUM,RDNS_DYNAMIC,SPF_HELO_NONE,SPF_NONE,
 XMAILER_REPORTBUG autolearn=ham autolearn_force=no
 version=3.4.6-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 25; hammy, 149; neutral, 54; spammy,
 1. spammytokens:0.944-+--H*r:bugs.debian.org
 hammytokens:0.000-+--H*F:U*carnil, 0.000-+--XDebbugsCc,
 0.000-+--X-Debbugs-Cc, 0.000-+--H*M:reportbug, 0.000-+--H*MI:reportbug
Return-path: <carnil@debian.org>
Received: from c-82-192-242-114.customer.ggaweb.ch ([82.192.242.114]:43720
 helo=eldamar.lan) by buxtehude.debian.org with esmtp (Exim 4.94.2)
 (envelope-from <carnil@debian.org>) id 1tPoMX-00Cm2m-T5
 for submit@bugs.debian.org; Mon, 23 Dec 2024 19:45:11 +0000
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: logback: CVE-2024-12798
Message-ID: <173498310527.2560491.4869077286221755852.reportbug@eldamar.lan>
X-Mailer: reportbug 13.0.2
Date: Mon, 23 Dec 2024 20:45:05 +0100
Delivered-To: submit@bugs.debian.org

Source: logback
Version: 1:1.2.11-6
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for logback.

CVE-2024-12798[0]:
| ACE vulnerability in JaninoEventEvaluator  by QOS.CH logback-core
| upto and including version 1.5.12 in Java applications allows
| attacker to execute arbitrary code by compromising an existing
| logback configuration file or by injecting an environment variable
| before program execution.      Malicious logback configuration files
| can allow the attacker to execute  arbitrary code using the
| JaninoEventEvaluator extension.    A successful attack requires the
| user to have write access to a  configuration file. Alternatively,
| the attacker could inject a malicious  environment variable pointing
| to a malicious configuration file. In both  cases, the attack
| requires existing privilege.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-12798
    https://www.cve.org/CVERecord?id=CVE-2024-12798
[1] https://logback.qos.ch/news.html#1.5.13
[2] https://github.com/qos-ch/logback/commit/2cb6d520df7592ef1c3a198f1b5df3c10c93e183

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore
]