SPECS/parfait.spec

@@ -1,6 +1,6 @@
 Name:          parfait
 Version:       0.5.4
-Release:       3%{?dist}
+Release:       4%{?dist}
 Summary:       Java libraries for Performance Co-Pilot (PCP)
 License:       ASL 2.0
 URL:           https://github.com/performancecopilot/parfait
@@ -57,6 +57,13 @@ BuildRequires: mvn(tec.uom:uom-se)
 
 BuildArch:     noarch
 
+# parfait used to have a dependency on log4j12. Since parfait 0.5.4-3, log4j is no longer a dependency.
+# This line makes sure that the log4j12 package will be removed when upgrading
+# to parfait 0.5.4-4, to remove all vulnerable log4j12 versions (CVE-2021-4104).
+# Also matches NVR 1.2.17-22.module+el8+...
+Obsoletes: log4j12 < 1.2.17-23
+Obsoletes: log4j12-javadoc < 1.2.17-23
+
 %description
 Parfait is a Java performance monitoring library that exposes and
 collects metrics through a variety of outputs.  It provides APIs
@@ -177,8 +184,12 @@ done
 %config(noreplace)%{_sysconfdir}/%{name}/jvm.json
 
 %changelog
+* Tue Jan 18 2022 Andreas Gerstmayr <agerstmayr@redhat.com> - 0.5.4-4
+- Obsolete (remove) vulnerable versions of log4j12 (NVR < 1.2.17-23)
+  when upgrading to parfait 0.5.4-4 (CVE-2021-4104)
+
 * Thu Dec 16 2021 Nathan Scott <nathans@redhat.com> - 0.5.4-3
-- Drop all code explicitly using Log4J (BZ 2031674)
+- Drop all code explicitly using Log4J (BZ 2032158)
 
 * Wed Nov 01 2017 Nathan Scott <nathans@redhat.com> - 0.5.4-2
 - Install a default configuration file for base JVM metrics.