| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: logback | Distribution: openSUSE Tumbleweed |
| Version: 1.6.0 | Vendor: openSUSE |
| Release: 1.1 | Build date: Fri Jul 24 04:59:20 2026 |
| Group: Development/Libraries/Java | Build host: reproducible |
| Size: 954768 | Source RPM: logback-1.6.0-1.1.src.rpm |
| Packager: https://bugs.opensuse.org | |
| Url: https://logback.qos.ch/ | |
| Summary: A Java logging library | |
Logback is intended as a successor to the popular log4j project. At present time, logback is divided into three modules, logback-core, logback-classic and logback-access. The logback-core module lays the groundwork for the other two modules. The logback-classic module can be assimilated to a significantly improved version of log4j. Moreover, logback-classic natively implements the SLF4J API so that you can readily switch back and forth between logback and other logging frameworks such as log4j or java.util.logging (JUL). The logback-access module integrates with Servlet containers, such as Tomcat and Jetty, to provide HTTP-access log functionality. Note that you could easily build your own module on top of logback-core.
EPL-1.0 OR LGPL-2.1-or-later
* Fri Jul 24 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 1.6.0
* Notable changes
In version 1.5.37 and subsequently in 1.6.x, support for
Janino-based conditional expressions was removed. Evaluating
arbitrary Java expressions with the Janino library had led to
numerous security vulnerabilities.
If you are upgrading from a version earlier than 1.5.37 and
your configuration files still use those older Janino-style
conditionals, you must migrate them to the new format using
the <condition> element (available since version version
1.5.20).
The <condition> element accepts implementations of the
PropertyCondition interface to decide whether a branch of the
configuration should apply. Logback-core ships with several
implementations of said interface. For details, see the
https://logback.qos.ch/manual/configuration.html#conditional
* Changes
+ Removed deprecated variables
° ch.qos.logback.classic.PatternLayout#DEFAULT_CONVERTER_MAP
° ch.qos.logback.classic.PatternLayout#defaultConverterMap
° ch.qos.logback.classic.util.ContextInitializer
[#]AUTOCONFIG_FILE
° ch.qos.logback.classic.util.ContextInitializer
[#]TEST_AUTOCONFIG_FILE
° ch.qos.logback.classic.util.ContextInitializer
[#]CONFIG_FILE_PROPERTY
+ Remove deprecated methods
° ch.qos.logback.classic.PatternLayout
[#]getDefaultConverterMap()
° ch.qos.logback.core.util.ExecutorServiceUtil
[#]newExecutorService()
° ch.qos.logback.core.util.VersionUtil
[#]getVersionOfArtifact(Class<?>)
° ch.qos.logback.core.pattern.PatternLayoutBase
[#]setContextForConverters
° ch.qos.logback.core.pattern.PatternLayoutEncoderBase
[#]setOutputPatternAsPresentationHeader
° ch.qos.logback.core.joran.spi.ConfigurationWatchList
[#]changeDetected
° ch.qos.logback.core.joran.GenericXMLConfigurator
[#]informContextOfURLUsedForConfiguration
° ch.qos.logback.core.model.ModelUtil#setProperty
° ch.qos.logback.core.model.ModelUtil#setProperties
° ch.qos.logback.core.joran.action.PreconditionValidator
[#]generic
° ch.qos.logback.core.util.EnvUtil#logbackVersion
° ch.qos.logback.classic.util.ClassicEnvUtil
[#]getVersionOfLogbackClassic
+ Remove deprecated class
° ch.qos.logback.classic.turbo.ReconfigureOnChangeFilter
+ In AsyncAppenderBase, the put(ILoggingEvent) method now has
the protected modifier to allow access from derived classes
+ Bump SLF4J dependency to version 2.0.18.
* Wed Jul 15 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 1.5.38
* Change of 1.5.38
+ In HardenedObjectInputStream, fixed a typo preventing
Throwable objects from being white-filtered
* Change of 1.5.37
+ Given the numerous vulnerabilities related to conditional
configuration processing based on the evaluation of Java
expressions using the Janino library, support for such
expressions has been removed
- Removed patch:
* new-janino.patch
+ not needed
* Mon Jul 13 2026 Fridrich Strba <fstrba@suse.com>
- Do not use the slf4j2 compatibility package, as the base slf4j
package is now on version 2.0.18
* Fri Jun 26 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 1.5.36
* Changes of 1.5.36
+ The 'condition' attribute in <if> elements now reject certain
references that are associated with ACE attacks
(bsc#1269222, CVE-2026-13006).
* Changes of 1.5.35
+ The 'condition' attribute in <if> elements now rejects unicode
escape sequences (\u and \U). This closes a bypass of the
existing prohibition on the new operator in Janino-evaluated
conditions (bsc#1269222, CVE-2026-13006). Please note that the
version 1.5.36 provides the full fix to this vulnerability.
+ Added ConfiguratorRank.AUTHENTICATING (rank 100), the highest
configurator rank, for certified/authenticating configurators
discovered via the ServiceLoader mechanism. ContextInitializer
now requires that at most one such configurator exist on the
classpath; if more than one is found, initialization aborts
with an error.
+ ConsoleCharsetPropertyDefiner is no longer shipped. The Java
21 multi-release compilation of logback-core has been
disabled, which removes this class from the published
artifact. Configurations that referenced
ch.qos.logback.core.property.ConsoleCharsetPropertyDefiner
will need an alternative approach for console charset
detection.
+ The logback-examples module is now included in the set of
artifacts published to Maven Central.
+ JoranConfigurator.makeAnotherInstance() and
DefaultJoranConfigurator.performMultiStepConfigurationFileSearch()
are now protected, allowing derived configurators to override
these methods.
* Wed Jun 10 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 1.5.34
* General changes between series
+ The 1.2.x series has been deprecated for several years and is
no longer maintained
+ In Logback 1.2.x/1.3.x, few optional components depend on
Java EE, whereas in logback versions 1.4.x/1.5.x, these
optional components depend on Jakarta EE. The 1.5.x series
continues the 1.4.x series, but with logback-access relocated
to its own repository
* Fixes
+ In case certain StackTraceElement values returned by the
Throwable.getStackTrace method are null,
StackTraceElementProxy substitutes a dummy instance instead of
throwing an IllegalArgumentException (#1040)
+ HardenedObjectInputStream will now throw an
InvalidClassException during deserialization attempts of Proxy
classes (bsc#1266783, CVE-2026-10532)
+ PropertiesConfiguratorModelHandler now registers properties
file URLs to the ConfigurationWatchList when scan is enabled
(via local scan="true" attribute or top-level configuration
scan), ensuring changes are detected and reconfiguration
occurs (issues/1034)
+ When processing <conversionRule> elements and both class and
converterClass attributes are specified, silently use the
class attribute without issuing a warning. However, if the
attribute values differ, a warning will be issued (issues/1031)
+ HardenedModelInputStream will no longer accept to deserialize
all classes located under the "java.lang" and "java.util"
packages but only a limited number of explicitly authorized
classes in those packages (bsc#1266783, CVE-2026-9828)
+ SSL parameters for SSLSocketAppender now enable hostname
verification by default. Moreover, the default protocol is now
"TLSv1.2"
+ When printing the status message field,
ViewStatusMessagesServletBase now escapes special characters
such as "&" as character entities
- Removed patches:
* logback-1.2.3-getCallerClass.patch
* logback-CVE-2024-12801-CVE-2024-12798.patch
* logback-CVE-2025-11226.patch
* logback-CVE-2026-1225.patch
+ not needed with this version
- Added patch:
* new-janino.patch
+ upgrade to new janino that has packages in org.codehaus
namespace
* Thu Jan 29 2026 Fridrich Strba <fstrba@suse.com>
- Added patch:
* logback-CVE-2026-1225.patch
+ backport of upstream fix for bsc#1257094, CVE-2026-1225: ACE
vulnerability in configuration file
* Fri Oct 03 2025 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 1.2.13
* Fixed NPE in ThrowableProxy if extractSupressedThrowables method
returns null. This fixes LOGBACK-1623
* Fixed incorrect use of HttpServletResponse.getStatus in
logback-access as reported in LOGBACK-1580
* Fixed incorrect use of HttpServletRequest.getParameterNames()
logback-access as reported in LOGBACK-1581
* Fixed incorrect SCP URL in Maven pom.xml. This issue was
reported in LOGBACK-1633
* Fixes for CVE-2023-6481 as well CVE-2023-6378 were back-ported
into the 1.2.x branch. Fixes will be effective only when run
under Java 9 and later.
Note that a successful exploitation of
CVE-2023-6378/CVE-2023-6381 requires that logback-receiver
component is enabled and also reachable by the attacker.
- Removed patch:
* logback-1.2.8-jetty.patch
+ not needed with this version
- Added patch:
* logback-CVE-2025-11226.patch
+ backport of upstream fix for bsc#1250715, CVE-2025-11226: ACE
vulnerability in conditional configuration file processing
* Fri Mar 28 2025 Fridrich Strba <fstrba@suse.com>
- Added patch:
* filtering.patch
+ Newer maven-filtering versions will throw error when trying
to filter binary files and failing to do so. This avoids
filtering on *.jks (Java Key Store) files.
* Wed Jan 08 2025 Gus Kenion <gus.kenion@suse.com>
- CVE-2024-12798 (bsc#1234742) Arbitrary code execution via
JaninoEventEvaluator
* Resolution: remove JaninoEventEvaluator
- CVE-2024-12801 (bsc#1234743) Server-Side Request Forgery (SSRF)
in SaxEventRecorder
* Resolution: prevent Server-Side Request Forgery (SSRF) attacks
by ignoring external DTD files in DOCTYPE
* Remove SaxEventRecorder
- Add logback-CVE-2024-12801-CVE-2024-12798.patch
* Wed Feb 21 2024 Gus Kenion <gus.kenion@suse.com>
- Use %patch -P N instead of deprecated %patchN.
* Sat Sep 09 2023 Fridrich Strba <fstrba@suse.com>
- Reproducible builds: use SOURCE_DATE_EPOCH for timestamp
/usr/share/doc/packages/logback /usr/share/doc/packages/logback/README.md /usr/share/java/logback /usr/share/java/logback/logback-classic-misc.jar /usr/share/java/logback/logback-classic.jar /usr/share/java/logback/logback-core.jar /usr/share/licenses/logback /usr/share/licenses/logback/LICENSE.txt /usr/share/maven-metadata/logback.xml /usr/share/maven-poms/logback /usr/share/maven-poms/logback/logback-classic-misc.pom /usr/share/maven-poms/logback/logback-classic.pom /usr/share/maven-poms/logback/logback-core.pom /usr/share/maven-poms/logback/logback-parent.pom
Generated by rpm2html 1.8.1
Fabrice Bellet, Mon Aug 3 00:04:55 2026