diff --git a/.gitignore b/.gitignore index 319ec53..c4e3cdf 100644 --- a/.gitignore +++ b/.gitignore @@ -19,3 +19,8 @@ /apache-log4j-2.13.0-src.tar.gz /apache-log4j-2.13.1-src.tar.gz /apache-log4j-2.13.3-src.tar.gz +/apache-log4j-2.14.1-src.tar.gz +/apache-log4j-2.15.0-src.tar.gz +/apache-log4j-2.16.0-src.tar.gz +/apache-log4j-2.17.0-src.tar.gz +/apache-log4j-2.17.1-src.tar.gz diff --git a/log4j.spec b/log4j.spec index 6b1420d..3c43ae5 100644 --- a/log4j.spec +++ b/log4j.spec @@ -1,14 +1,14 @@ %bcond_without jp_minimal Name: log4j -Version: 2.13.3 -Release: 4%{?dist} +Version: 2.17.1 +Release: 1%{?dist} Summary: Java logging package BuildArch: noarch License: ASL 2.0 -URL: http://logging.apache.org/%{name} -Source0: http://www.apache.org/dist/logging/%{name}/%{version}/apache-%{name}-%{version}-src.tar.gz +URL: https://logging.apache.org/%{name} +Source0: https://www.apache.org/dist/logging/%{name}/%{version}/apache-%{name}-%{version}-src.tar.gz Patch2: logging-log4j-Remove-unsupported-EventDataConverter.patch @@ -26,11 +26,11 @@ BuildRequires: mvn(org.apache:apache:pom:) BuildRequires: mvn(org.apache.maven.plugins:maven-assembly-plugin) BuildRequires: mvn(org.apache.maven.plugins:maven-dependency-plugin) BuildRequires: mvn(org.codehaus.mojo:build-helper-maven-plugin) -BuildRequires: mvn(org.fusesource.jansi:jansi:1) +BuildRequires: mvn(org.fusesource.jansi:jansi) BuildRequires: mvn(org.jctools:jctools-core) BuildRequires: mvn(org.osgi:osgi.core) BuildRequires: mvn(org.slf4j:slf4j-api) -BuildRequires: mvn(org.slf4j:slf4j-ext) +BuildRequires: mvn(jakarta.servlet:jakarta.servlet-api) %if %{without jp_minimal} BuildRequires: mvn(com.datastax.cassandra:cassandra-driver-core) @@ -180,9 +180,9 @@ rm -r log4j-core/src/main/java/org/apache/logging/log4j/core/appender/mom/kafka # we don't have commons-dbcp2 %pom_disable_module %{name}-jdbc-dbcp2 -# We have mongodb 4 -%pom_disable_module %{name}-mongodb2 +# We don't have mmongo-java %pom_disable_module %{name}-mongodb3 +%pom_disable_module %{name}-mongodb4 # System scoped dep provided by JDK %pom_remove_dep :jconsole %{name}-jmx-gui @@ -197,8 +197,9 @@ rm -r log4j-core/src/main/java/org/apache/logging/log4j/core/appender/mom/kafka # tests are disabled %pom_remove_plugin :maven-failsafe-plugin -# Update required version of jansi 1.x -%pom_xpath_set "//pom:dependency[pom:artifactId='jansi']/pom:version" 1.18 +# Remove deps on slf4j-ext, it is no longer available in Fedora 35 +%pom_remove_dep -r :slf4j-ext +%pom_remove_parent %if %{with jp_minimal} %pom_disable_module %{name}-taglib @@ -213,7 +214,9 @@ rm -r log4j-core/src/main/java/org/apache/logging/log4j/core/appender/mom/kafka %pom_disable_module %{name}-cassandra %pom_disable_module %{name}-appserver %pom_disable_module %{name}-spring-cloud-config +%pom_disable_module %{name}-spring-boot %pom_disable_module %{name}-kubernetes +%pom_disable_module %{name}-layout-template-json %pom_remove_dep -r :jackson-dataformat-yaml %pom_remove_dep -r :jackson-dataformat-xml @@ -252,7 +255,7 @@ rm -r log4j-1.2-api/src/main/java/org/apache/log4j/or/jms %build # missing test deps (mockejb) -%mvn_build -f +%mvn_build -f -j %install %mvn_install @@ -276,13 +279,32 @@ rm -r log4j-1.2-api/src/main/java/org/apache/log4j/or/jms %{_bindir}/%{name}-jmx %endif -%files javadoc -f .mfiles-javadoc -%doc LICENSE.txt NOTICE.txt +#%%files javadoc -f .mfiles-javadoc +#%%doc LICENSE.txt NOTICE.txt %changelog -* Fri Apr 16 2021 Mohan Boddu - 2.13.3-4 -- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 +* Tue Dec 28 2021 Paul Wouters - 2.17.1-1 +- Update log4j to 2.17.1 for CVE-2021-44832 RCE via JDBC Appender (when attacker controls config) + +* Sat Dec 18 2021 Paul Wouters - 2.17.0-1 +- Update log4j to 2.17.0 for CVE-2021-45105 Denial of Service attack + +* Mon Dec 13 2021 Paul Wouters - 2.16.0-1 +- Update log4j to 2.16.0 - Disables JNDI by default + +* Sun Dec 12 2021 Sérgio Basto - 2.15.0-1 +- Update log4j to 2.15.0 (#2030907) +- Security fix for CVE-2021-44228 (#2030945) + +* Sun Aug 01 2021 Sérgio Basto - 2.14.1-1 +- Update to 2.14.1 +- Disable javadoc (#1988896) +- Build with jansi-2 +- Remove deps on slf4j-ext (no longer available in Fedora 35) + +* Thu Jul 22 2021 Fedora Release Engineering - 2.13.3-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild * Tue Jan 26 2021 Fedora Release Engineering - 2.13.3-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild diff --git a/sources b/sources index ae2619d..e09283e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (apache-log4j-2.13.3-src.tar.gz) = b759f008e99ba3eaeb7f928e66d96529ece6fc9d9532a825775e11a00c256543aaa43a8e7f383b729be23a21ba90df42b8b12aa2802d40a0e227e17b629d8ecc +SHA512 (apache-log4j-2.17.1-src.tar.gz) = 21cdfca54eb0d6af261a5ae89ff98197473d9c0203b0ab530f3aef6c90957bfb95a423983c8a19d7fbab05ec194b6fad8e46628e32270dd8b94ddd194a1cb177