From c26507f476395bf71ec69dd9bef9f95f1f406c6f Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Mon, 13 Dec 2021 22:47:19 -0800 Subject: [PATCH 1/4] Update to 2.16.0 (fixes critical CVE-2021-44228) (#2030945) --- .gitignore | 1 + log4j.spec | 20 +++++++++++++------- sources | 2 +- 3 files changed, 15 insertions(+), 8 deletions(-) diff --git a/.gitignore b/.gitignore index 319ec53..1bb3780 100644 --- a/.gitignore +++ b/.gitignore @@ -19,3 +19,4 @@ /apache-log4j-2.13.0-src.tar.gz /apache-log4j-2.13.1-src.tar.gz /apache-log4j-2.13.3-src.tar.gz +/apache-log4j-2.16.0-src.tar.gz diff --git a/log4j.spec b/log4j.spec index 20b13ef..6346465 100644 --- a/log4j.spec +++ b/log4j.spec @@ -1,8 +1,8 @@ %bcond_without jp_minimal Name: log4j -Version: 2.13.3 -Release: 3%{?dist} +Version: 2.16.0 +Release: 1%{?dist} Summary: Java logging package BuildArch: noarch License: ASL 2.0 @@ -26,11 +26,12 @@ BuildRequires: mvn(org.apache:apache:pom:) BuildRequires: mvn(org.apache.maven.plugins:maven-assembly-plugin) BuildRequires: mvn(org.apache.maven.plugins:maven-dependency-plugin) BuildRequires: mvn(org.codehaus.mojo:build-helper-maven-plugin) -BuildRequires: mvn(org.fusesource.jansi:jansi:1) +BuildRequires: mvn(org.fusesource.jansi:jansi) BuildRequires: mvn(org.jctools:jctools-core) BuildRequires: mvn(org.osgi:osgi.core) BuildRequires: mvn(org.slf4j:slf4j-api) BuildRequires: mvn(org.slf4j:slf4j-ext) +BuildRequires: mvn(jakarta.servlet:jakarta.servlet-api) %if %{without jp_minimal} BuildRequires: mvn(com.datastax.cassandra:cassandra-driver-core) @@ -180,9 +181,9 @@ rm -r log4j-core/src/main/java/org/apache/logging/log4j/core/appender/mom/kafka # we don't have commons-dbcp2 %pom_disable_module %{name}-jdbc-dbcp2 -# We have mongodb 4 -%pom_disable_module %{name}-mongodb2 +# We don't have mongo-java %pom_disable_module %{name}-mongodb3 +%pom_disable_module %{name}-mongodb4 # System scoped dep provided by JDK %pom_remove_dep :jconsole %{name}-jmx-gui @@ -197,8 +198,8 @@ rm -r log4j-core/src/main/java/org/apache/logging/log4j/core/appender/mom/kafka # tests are disabled %pom_remove_plugin :maven-failsafe-plugin -# Update required version of jansi 1.x -%pom_xpath_set "//pom:dependency[pom:artifactId='jansi']/pom:version" 1.18 +# parent (apache-logging-parent) is not packaged +%pom_remove_parent %if %{with jp_minimal} %pom_disable_module %{name}-taglib @@ -213,7 +214,9 @@ rm -r log4j-core/src/main/java/org/apache/logging/log4j/core/appender/mom/kafka %pom_disable_module %{name}-cassandra %pom_disable_module %{name}-appserver %pom_disable_module %{name}-spring-cloud-config +%pom_disable_module %{name}-spring-boot %pom_disable_module %{name}-kubernetes +%pom_disable_module %{name}-layout-template-json %pom_remove_dep -r :jackson-dataformat-yaml %pom_remove_dep -r :jackson-dataformat-xml @@ -281,6 +284,9 @@ rm -r log4j-1.2-api/src/main/java/org/apache/log4j/or/jms %changelog +* Mon Dec 13 2021 Adam Williamson - 2.16.0-1 +- Update to 2.16.0 (fixes critical CVE-2021-44228) + * Tue Jan 26 2021 Fedora Release Engineering - 2.13.3-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild diff --git a/sources b/sources index ae2619d..9f7eeee 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (apache-log4j-2.13.3-src.tar.gz) = b759f008e99ba3eaeb7f928e66d96529ece6fc9d9532a825775e11a00c256543aaa43a8e7f383b729be23a21ba90df42b8b12aa2802d40a0e227e17b629d8ecc +SHA512 (apache-log4j-2.16.0-src.tar.gz) = c520a5af1ac4161f0b0c9cb466a0c6bf349cce567b8c1c1ee01fc0b0258852f0ef4f7a7967f367168f4395e7fdd981fd35b7cb6d5f236b6421699bd2b1ccf919 From d2608e27ed7e494947feef40cd80f820852ed0dd Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Sat, 18 Dec 2021 10:39:08 -0500 Subject: [PATCH 2/4] - Update log4j to 2.17.0 for CVE-2021-45105 Denial of Service attack --- .gitignore | 1 + log4j.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 1bb3780..ce415e2 100644 --- a/.gitignore +++ b/.gitignore @@ -20,3 +20,4 @@ /apache-log4j-2.13.1-src.tar.gz /apache-log4j-2.13.3-src.tar.gz /apache-log4j-2.16.0-src.tar.gz +/apache-log4j-2.17.0-src.tar.gz diff --git a/log4j.spec b/log4j.spec index 6346465..024bb61 100644 --- a/log4j.spec +++ b/log4j.spec @@ -1,7 +1,7 @@ %bcond_without jp_minimal Name: log4j -Version: 2.16.0 +Version: 2.17.0 Release: 1%{?dist} Summary: Java logging package BuildArch: noarch @@ -284,6 +284,9 @@ rm -r log4j-1.2-api/src/main/java/org/apache/log4j/or/jms %changelog +* Sat Dec 18 2021 Paul Wouters - 2.17.0-1 +- Update log4j to 2.17.0 for CVE-2021-45105 Denial of Service attack + * Mon Dec 13 2021 Adam Williamson - 2.16.0-1 - Update to 2.16.0 (fixes critical CVE-2021-44228) diff --git a/sources b/sources index 9f7eeee..59e1b34 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (apache-log4j-2.16.0-src.tar.gz) = c520a5af1ac4161f0b0c9cb466a0c6bf349cce567b8c1c1ee01fc0b0258852f0ef4f7a7967f367168f4395e7fdd981fd35b7cb6d5f236b6421699bd2b1ccf919 +SHA512 (apache-log4j-2.17.0-src.tar.gz) = 23433baa39a8cc76164ae96307e85b9e4ea671028015df6171bfaf025a1e1aaacf76a94a1beef67aada56952f013a8eae94024869a8530f42a3747ba70cc3a90 From 2d042cddaf545c068c95542b86381f0a83763f8b Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Sat, 18 Dec 2021 11:18:24 -0500 Subject: [PATCH 3/4] re-fixup jansi dep to jansi1 --- log4j.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/log4j.spec b/log4j.spec index 024bb61..bd5f6b1 100644 --- a/log4j.spec +++ b/log4j.spec @@ -26,7 +26,7 @@ BuildRequires: mvn(org.apache:apache:pom:) BuildRequires: mvn(org.apache.maven.plugins:maven-assembly-plugin) BuildRequires: mvn(org.apache.maven.plugins:maven-dependency-plugin) BuildRequires: mvn(org.codehaus.mojo:build-helper-maven-plugin) -BuildRequires: mvn(org.fusesource.jansi:jansi) +BuildRequires: mvn(org.fusesource.jansi:jansi:1) BuildRequires: mvn(org.jctools:jctools-core) BuildRequires: mvn(org.osgi:osgi.core) BuildRequires: mvn(org.slf4j:slf4j-api) @@ -198,6 +198,9 @@ rm -r log4j-core/src/main/java/org/apache/logging/log4j/core/appender/mom/kafka # tests are disabled %pom_remove_plugin :maven-failsafe-plugin +# Update required version of jansi 1.x +%pom_xpath_set "//pom:dependency[pom:artifactId='jansi']/pom:version" 1.18 + # parent (apache-logging-parent) is not packaged %pom_remove_parent From d76fb4d7973235f623dbc2003135df35ad4abeba Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Tue, 28 Dec 2021 16:55:25 -0500 Subject: [PATCH 4/4] - Update log4j to 2.17.1 for CVE-2021-44832 RCE via JDBC Appender (when attacker controls config) --- .gitignore | 1 + log4j.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index ce415e2..5c9ca08 100644 --- a/.gitignore +++ b/.gitignore @@ -21,3 +21,4 @@ /apache-log4j-2.13.3-src.tar.gz /apache-log4j-2.16.0-src.tar.gz /apache-log4j-2.17.0-src.tar.gz +/apache-log4j-2.17.1-src.tar.gz diff --git a/log4j.spec b/log4j.spec index bd5f6b1..ca36144 100644 --- a/log4j.spec +++ b/log4j.spec @@ -1,7 +1,7 @@ %bcond_without jp_minimal Name: log4j -Version: 2.17.0 +Version: 2.17.1 Release: 1%{?dist} Summary: Java logging package BuildArch: noarch @@ -287,6 +287,9 @@ rm -r log4j-1.2-api/src/main/java/org/apache/log4j/or/jms %changelog +* Tue Dec 28 2021 Paul Wouters - 2.17.1-1 +- Update log4j to 2.17.1 for CVE-2021-44832 RCE via JDBC Appender (when attacker controls config) + * Sat Dec 18 2021 Paul Wouters - 2.17.0-1 - Update log4j to 2.17.0 for CVE-2021-45105 Denial of Service attack diff --git a/sources b/sources index 59e1b34..e09283e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (apache-log4j-2.17.0-src.tar.gz) = 23433baa39a8cc76164ae96307e85b9e4ea671028015df6171bfaf025a1e1aaacf76a94a1beef67aada56952f013a8eae94024869a8530f42a3747ba70cc3a90 +SHA512 (apache-log4j-2.17.1-src.tar.gz) = 21cdfca54eb0d6af261a5ae89ff98197473d9c0203b0ab530f3aef6c90957bfb95a423983c8a19d7fbab05ec194b6fad8e46628e32270dd8b94ddd194a1cb177