Is a fix for CVE-2024-12798 going to be made to the 1.4.x line?

[evossler]

The vulnerability in JaninoEventEvaluator was fixed in 1.5.13, but I can't find any information on if/when it will be fixed on the 1.4.x line.

I maintain a number of apps that are using spring boot 3.2 which depends on logback 1.4. (Updating them to SB 3.4 is on my roadmap, but won't happen overnight, so I'm hoping a logback 1.4.15 might be coming soon to help me out?)

[chris-orchard]

The answer is no.

I raised the same question as an issue here, after seeing no reply on this discusson:
#907 (comment)

The answer there says 1.4.x isn't maintained but 1.5.x is a drop in replacement.

Maybe you can raise on spring boot's issue logger about swaping 3.2 to use 1.5.x?