- Update log4j to 2.17.1 for CVE-2021-44832 RCE via JDBC Appender (when attacker controls config)

.gitignore

@@ -19,3 +19,6 @@
 /apache-log4j-2.13.0-src.tar.gz
 /apache-log4j-2.13.1-src.tar.gz
 /apache-log4j-2.13.3-src.tar.gz
+/apache-log4j-2.16.0-src.tar.gz
+/apache-log4j-2.17.0-src.tar.gz
+/apache-log4j-2.17.1-src.tar.gz

log4j.spec

@@ -1,8 +1,8 @@
 %bcond_without  jp_minimal
 
 Name:           log4j
-Version:        2.13.3
-Release:        3%{?dist}
+Version:        2.17.1
+Release:        1%{?dist}
 Summary:        Java logging package
 BuildArch:      noarch
 License:        ASL 2.0
@@ -31,6 +31,7 @@ BuildRequires:  mvn(org.jctools:jctools-core)
 BuildRequires:  mvn(org.osgi:osgi.core)
 BuildRequires:  mvn(org.slf4j:slf4j-api)
 BuildRequires:  mvn(org.slf4j:slf4j-ext)
+BuildRequires:  mvn(jakarta.servlet:jakarta.servlet-api)
 
 %if %{without jp_minimal}
 BuildRequires:  mvn(com.datastax.cassandra:cassandra-driver-core)
@@ -180,9 +181,9 @@ rm -r log4j-core/src/main/java/org/apache/logging/log4j/core/appender/mom/kafka
 # we don't have commons-dbcp2
 %pom_disable_module %{name}-jdbc-dbcp2
 
-# We have mongodb 4
-%pom_disable_module %{name}-mongodb2
+# We don't have mongo-java
 %pom_disable_module %{name}-mongodb3
+%pom_disable_module %{name}-mongodb4
 
 # System scoped dep provided by JDK
 %pom_remove_dep :jconsole %{name}-jmx-gui
@@ -200,6 +201,9 @@ rm -r log4j-core/src/main/java/org/apache/logging/log4j/core/appender/mom/kafka
 # Update required version of jansi 1.x
 %pom_xpath_set "//pom:dependency[pom:artifactId='jansi']/pom:version" 1.18
 
+# parent (apache-logging-parent) is not packaged
+%pom_remove_parent
+
 %if %{with jp_minimal}
 %pom_disable_module %{name}-taglib
 %pom_disable_module %{name}-jmx-gui
@@ -213,7 +217,9 @@ rm -r log4j-core/src/main/java/org/apache/logging/log4j/core/appender/mom/kafka
 %pom_disable_module %{name}-cassandra
 %pom_disable_module %{name}-appserver
 %pom_disable_module %{name}-spring-cloud-config
+%pom_disable_module %{name}-spring-boot
 %pom_disable_module %{name}-kubernetes
+%pom_disable_module %{name}-layout-template-json
 
 %pom_remove_dep -r :jackson-dataformat-yaml
 %pom_remove_dep -r :jackson-dataformat-xml
@@ -281,6 +287,15 @@ rm -r log4j-1.2-api/src/main/java/org/apache/log4j/or/jms
 
 
 %changelog
+* Tue Dec 28 2021 Paul Wouters <paul.wouters@aiven.io> - 2.17.1-1
+- Update log4j to 2.17.1 for CVE-2021-44832 RCE via JDBC Appender (when attacker controls config)
+
+* Sat Dec 18 2021 Paul Wouters <paul.wouters@aiven.io> - 2.17.0-1
+- Update log4j to 2.17.0 for CVE-2021-45105 Denial of Service attack
+
+* Mon Dec 13 2021 Adam Williamson <awilliam@redhat.com> - 2.16.0-1
+- Update to 2.16.0 (fixes critical CVE-2021-44228)
+
 * Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.13.3-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
 

sources

@@ -1 +1 @@
-SHA512 (apache-log4j-2.13.3-src.tar.gz) = b759f008e99ba3eaeb7f928e66d96529ece6fc9d9532a825775e11a00c256543aaa43a8e7f383b729be23a21ba90df42b8b12aa2802d40a0e227e17b629d8ecc
+SHA512 (apache-log4j-2.17.1-src.tar.gz) = 21cdfca54eb0d6af261a5ae89ff98197473d9c0203b0ab530f3aef6c90957bfb95a423983c8a19d7fbab05ec194b6fad8e46628e32270dd8b94ddd194a1cb177