<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">Ciao Angelo,</div><div class=""><br class=""></div><div class="">To reproduce this might take quite a bit of work, as the report you copied doesn’t provide details of how the MITM cert was spoofed. It might be as simple as not validating the cert at all. But if you have support from JFrog, then I would be best to contact them for more details.</div><div class=""><br class=""></div><div class="">I don’t currently use logback myself, but when I did I never relied on any feature that connected out to TLS endpoints. If you don’t either, then you can ignore this issue.</div><div class=""><br class=""></div><div class="">If your logback usage does include connecting out to TLS endpoints, then in each case you need to consider how confidential is that data, what could the impact of a MITM be, and what control do you have over the cert validation.</div><div class=""><br class=""></div><div class="">The problem is that there are many ways in which TLS connections can be made, even just parsing an XML document can cause network requests.</div><div class=""><br class=""></div><div class="">David</div><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 27 Aug 2021, at 17:31, Angelo Rauseo <<a href="mailto:angelo.rauseo@workday.com" class="">angelo.rauseo@workday.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta charset="UTF-8" class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Hello everyone,<o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I am looking for details about a vulnerability listed in JFrog X-Ray (see below) that does not have much data attached to it in the report (no CVE, no links to analysis). My end goal would be to eventually help resolve it, but I have no data about the source to start from.<o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Anyone here that can help me assess it?<o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Thank you for your time and assistance!<o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Angelo<o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">┌─────────────────────┬────────────────────────────────────────────────────────────────────────────────────────────────────┐<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">│ Summary │ logback SSL Certificate Validation Failure MitM Spoofing │<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">├─────────────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────┤<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">│ Severity │ MEDIUM │<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">├─────────────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────┤<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">│ Description │ logback contains a flaw as X.509 certificates are not properly validated. By spoofing the TLS/SSL │<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">│ │ server via a certificate that appears valid, an attacker with the ability to intercept network │<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">│ │ traffic (e.g. MitM, DNS cache poisoning) can disclose and optionally manipulate transmitted data. │<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">├─────────────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────┤<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">│ Type │ SECURITY │<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">├─────────────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────┤<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">│ Provider │ JFrog │<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">├─────────────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────┤<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">│ Issues │ 4.0/CVSS:2.0/AV:N/AC:H/Au:N/C:P/I:P/A:N │<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">├─────────────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────┤<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">│ Edited │ 2021-04-15T09:22:04Z │<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">├─────────────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────┤<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">│ Created │ 2019-05-02T00:00:00.297Z │<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">├─────────────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────┤<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">│ Impact paths │ - │<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">│ │ /sha256__11533f8a115abc3bbf6840bebe91a8616a0ee04cd4bdad4094ed62e6f86d4432.tar.gz/usr/share/fugu/li │<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">│ │ b/ch.qos.logback-logback-core-1.2.3.jar │<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">├─────────────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────┤<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">│ │ Affected component ID:<span class="Apple-converted-space"> </span><a href="gav://ch.qos.logback:logback-core:1.2.3" class="">gav://ch.qos.logback:logback-core:1.2.3</a> │<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">├─────────────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────┤<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">│ Vulnerable versions │ 1.0.12 ≤ Version ≤ 1.3.0-alpha5 │<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">├─────────────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────┤<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">│ Fixed versions │ │<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class="">└─────────────────────┴────────────────────────────────────────────────────────────────────────────────────────────────────┘<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 8pt; font-family: "Andale Mono";" class=""><o:p class=""> </o:p></span></div></div><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">_______________________________________________</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">logback-user mailing list</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><a href="mailto:logback-user@qos.ch" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">logback-user@qos.ch</a><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><a href="http://mailman.qos.ch/mailman/listinfo/logback-user" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">http://mailman.qos.ch/mailman/listinfo/logback-user</a></div></blockquote></div><br class=""></body></html>