[From nobody Sun Sep 13 04:35:04 2026 Received: (at submit) by bugs.debian.org; 1 Feb 2026 08:19:48 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-109.0 required=4.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,FOURLA,FROMDEVELOPER, SPF_HELO_NONE,SPF_NONE,UNPARSEABLE_RELAY,USER_IN_DKIM_WELCOMELIST, XMAILER_REPORTBUG autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 30; hammy, 150; neutral, 79; spammy, 0. spammytokens: hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin, 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311, 0.000-+--H*RT:311, 0.000-+--H*RT:108 Return-path: <carnil@debian.org> Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:54096) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1vmSCK-00EAtA-0v for submit@bugs.debian.org; Sun, 01 Feb 2026 07:48:44 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Date:Message-ID:Subject:To:From: Content-Transfer-Encoding:MIME-Version:Content-Type:Reply-To:Cc:Content-ID: Content-Description:In-Reply-To:References; bh=68RjO6NVQZBXlK9dfzYW/Us1I3ZSaRftk+gVPsLLuJE=; b=I0r8VuuByfmqq5WN4JE+EhUULP ONmdX/TtULAt6jO1VxaifCql2jucRyWXClqSWmLvXwN4ujZzdDwQDgPeFHP/j58xUcNCP4Ng5NZ5a v7hz/0TMMmgRwXFgE10k4bqE1KJrn8kuD0dqvucCTI2ge0ZZ1ctpD9H9NBQI4Ym25KpYwZNfwCAdA SsIr8JB0GQD81vs2aB2Jkx6DmnWL1WmHOLJSst8jblxurw8O73CGpCe14+gmk0KffGxvubhnLgUJn 8dI4vHdv3Jstp1cXMBCBENbjTJMKB3dsY1cdA3W+xJArw+ol+CEkq+sAZLcTuLFdlWokeDaFpXuVS z8zy5hqA==; Received: from authenticated user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.94.2) (envelope-from <carnil@debian.org>) id 1vmSCG-0037zS-Ke for submit@bugs.debian.org; Sun, 01 Feb 2026 07:48:42 +0000 Received: from eldamar.lan (localhost [IPv6:::1]) by eldamar.lan (Postfix) with ESMTP id CC420BE2EE7 for <submit@bugs.debian.org>; Sun, 01 Feb 2026 08:48:39 +0100 (CET) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Salvatore Bonaccorso <carnil@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: logback: CVE-2026-1225 Message-ID: <176993211979.2913352.12970549415278201911.reportbug@eldamar.lan> X-Mailer: reportbug 13.2.0 Date: Sun, 01 Feb 2026 08:48:39 +0100 X-Debian-User: carnil Delivered-To: submit@bugs.debian.org Source: logback Version: 1:1.2.11-6 Severity: important Tags: security upstream X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org> Hi Tony and Java maintainers team, The following vulnerability was published for logback. I'm not certain that is affecting the older version we have, please check ideally provide back if you find where the issue has been introduced. OTOH the issue might be considered minor? If you can isolate the fixing commit from 1.5.25 that would be great. CVE-2026-1225[0]: | ACE vulnerability in configuration file processing by QOS.CH | logback-core up to and including version 1.5.24 in Java | applications, allows an attacker to instantiate classes already | present on the class path by compromising an existing logback | configuration file. The instantiation of a potentially malicious | Java class requires that said class is present on the user's class- | path. In addition, the attacker must have write access to a | configuration file. However, after successful instantiation, the | instance is very likely to be discarded with no further ado. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-1225 https://www.cve.org/CVERecord?id=CVE-2026-1225 [1] https://logback.qos.ch/news.html#1.5.25 Please adjust the affected versions in the BTS as needed. Regards, Salvatore ]