apache-log4j2 2.17.0-1 source package in Debian

Changelog

apache-log4j2 (2.17.0-1) unstable; urgency=high

  * Team upload.
  * New upstream version 2.17.0.
    - Fix CVE-2021-45105:
      Apache Log4j2 did not protect from uncontrolled recursion from
      self-referential lookups. When the logging configuration uses a
      non-default Pattern Layout with a Context Lookup (for example,
      $${ctx:loginId}), attackers with control over Thread Context Map (MDC)
      input data can craft malicious input data that contains a recursive
      lookup, resulting in a denial of service. (Closes: #1001891)
      Thanks to Salvatore Bonaccorso for the report.

 -- Markus Koschany <email address hidden>  Sat, 18 Dec 2021 17:09:22 +0100