fix logback jar security issue