Ubuntu
apache-log4j2 package

apache-log4j2 2.16.0-1 source package in Ubuntu

Changelog

apache-log4j2 (2.16.0-1) unstable; urgency=high

  * Team upload.
  * New upstream version 2.16.0.
    - Fix CVE-2021-45046:
      It was found that the fix to address CVE-2021-44228 in Apache Log4j
      2.15.0 was incomplete in certain non-default configurations. This could
      allow attackers with control over Thread Context Map (MDC) input data
      when the logging configuration uses a non-default Pattern Layout with
      either a Context Lookup (for example, $${ctx:loginId}) or a Thread
      Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data
      using a JNDI Lookup pattern resulting in a denial of service (DOS)
      attack.
      Thanks to Salvatore Bonaccorso for the report. (Closes: #1001729)

 -- Markus Koschany <email address hidden>  Wed, 15 Dec 2021 02:38:06 +0100

Upload details

Uploaded by:
Debian Java Maintainers
Uploaded to:
Sid
Original maintainer:
Debian Java Maintainers
Architectures:
all
Section:
misc
Urgency:
Very Urgent

See full publishing history Publishing

Series Pocket Published Component Section

Builds

Jammy: [FULLYBUILT] amd64

Downloads

File Size SHA-256 Checksum
apache-log4j2_2.16.0-1.dsc 2.9 KiB 0303d3a9221df4a1f8d71c6192fab55df6b7e3129d0ce1f0a05fa1b346b011e1
apache-log4j2_2.16.0.orig.tar.xz 1.2 MiB d36a7556e7027819aaceef02838dcfaa3dd368f74f92b9585b2b6a442eb2194f
apache-log4j2_2.16.0-1.debian.tar.xz 7.2 KiB bac5638d94b45cb184a15a7ae1e21f9b2facd58671a3cc78a5a83bc97d5037e5

Available diffs

No changes file available.

Binary packages built by this source

liblog4j2-java: Apache Log4j - Logging Framework for Java

 Apache Log4j 2 is an upgrade to Log4j that provides significant improvements
 over its predecessor, Log4j 1.x:
 .
 API Separation: The API for Log4j is separate from the implementation making
 it clear for application developers which classes and methods they can use
 while ensuring forward compatibility.
 .
 Improved Performance: Log4j 2 contains next-generation Asynchronous Loggers
 based on the LMAX Disruptor library. In multi-threaded scenarios Asynchronous
 Loggers have 10 times higher throughput and orders of magnitude lower latency
 than Log4j 1.x.
 .
 Support for multiple APIs: While the Log4j 2 API will provide the best
 performance, Log4j 2 provides support for the SLF4J and Commons Logging APIs.
 .
 Automatic Reloading of Configurations: Log4j 2 can automatically reload its
 configuration upon modification. It will do so without losing log events
 while reconfiguration is taking place.
 .
 Advanced Filtering: Log4j 2 supports filtering based on context
 data, markers, regular expressions, and other components in the Log event.
 Filtering can be specified to apply to all events before being passed to
 Loggers or as they pass through Appenders.
 .
 Plugin Architecture: Log4j uses the plugin pattern to configure components.
 As such, no code is needed to create and configure an Appender, Layout,
 Pattern Converter, and so on. Log4j automatically recognizes plugins
 and uses them when a configuration references them.
 .
 Property Support: Properties can be referenced in a configuration, Log4j will
 directly replace them, or Log4j will pass them to an underlying component that
 will dynamically resolve them. Properties come from values defined in the
 configuration file, system properties, environment variables, the
 ThreadContext Map, and data present in the event.