apache-log4j2 2.17.1-1 source package in Debian

Changelog

apache-log4j2 (2.17.1-1) unstable; urgency=high

  * Team upload.
  * New upstream version 2.17.1.
    - Fix CVE-2021-44832:
      Apache Log4j2 is vulnerable to a remote code execution
      (RCE) attack where an attacker with permission to modify the logging
      configuration file can construct a malicious configuration using a JDBC
      Appender with a data source referencing a JNDI URI which can execute
      remote code. This issue is fixed by limiting JNDI data source names to
      the java protocol.
      Thanks to Salvatore Bonaccorso for the report. (Closes: #1002813)

 -- Markus Koschany <email address hidden>  Wed, 29 Dec 2021 11:44:21 +0100