Hi Folks, I need some help on some vulnerabilities reported on the dependency libraries used by Grails. CVE's 1. CVE-2024-12798 - logback-classic - Medium - https://security.snyk.io/vuln/SNYK-JAVA-CHQOSLOGBACK-8539867 2. CVE-2024-12801 - logback-core - Low - https://security.snyk.io/vuln/SNYK-JAVA-CHQOSLOGBACK-8539865 - We is using Spring Boot version 2.7.18 in one of our MicroServices. However, this version does not support SLF4J 2.x (the current version is 1.7.36), which is required for utilizing logback-classic 1.5.x (the recommended version to address vulnerabilities). • Please note that directly upgrading Spring Boot to version 3.x is not feasible due to compatibility issues with Grails (currently at version 6.2.1, which supports Spring Boot 2.7). • Moving to Grails 7 is not a possibility yet since it not a GA'ed Version. - As a result, the upgrade process is limited by the following dependencies: Grails → Spring Boot → Logback → SLF4J Is there a plan to address these in v6.2?

can you exclude the logback version with the issues and included the fixed one in your build.gradle?

For CVE-2024-12798: you may be able to mitigate the risk by ensuring that you are not using JaninoEventEvaluator. https://logback.qos.ch/manual/filters.html#JaninoEventEvaluator . "A successful attack requires the user to have write access to a configuration file" https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-12798 so this requires file system access to exploit.