Accepted apache-log4j2 2.12.3-0+deb9u1 (source) into oldoldstable
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 26 Dec 2021 21:40:43 CET
Source: apache-log4j2
Binary: liblog4j2-java
Architecture: source
Version: 2.12.3-0+deb9u1
Distribution: stretch-security
Urgency: high
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Markus Koschany <apo@debian.org>
Description:
liblog4j2-java - Apache Log4j - Logging Framework for Java
Checksums-Sha1:
020377c9eefccdb44f280d7379c82bdcef162f47 3024 apache-log4j2_2.12.3-0+deb9u1.dsc
a9144816470dcb574159dc4736889d982f4aded0 1118852 apache-log4j2_2.12.3.orig.tar.xz
de887f9572a90fa942b7edaac876ebc11b6e12ed 6748 apache-log4j2_2.12.3-0+deb9u1.debian.tar.xz
a17c74a8bea851da1560a85454ab2cb7b29107b3 17215 apache-log4j2_2.12.3-0+deb9u1_amd64.buildinfo
Checksums-Sha256:
7246b7c191e012a2a238ebdf81fcd389951bf1b7334a9fbc06ec6090c76f1248 3024 apache-log4j2_2.12.3-0+deb9u1.dsc
8a4c541dba5295e52aad750d899c477bc8f6bb9749879ab1dfae8ba6b1af002c 1118852 apache-log4j2_2.12.3.orig.tar.xz
d0ba1558229c9ec5dab4b12ef5e82ff5191d0adedf53a9770d80454c83fd1ff9 6748 apache-log4j2_2.12.3-0+deb9u1.debian.tar.xz
7ce71aa2b4b448cec0daba3ba9e08d1d72d64df494158c5b0d4abccb5570b28c 17215 apache-log4j2_2.12.3-0+deb9u1_amd64.buildinfo
Changes:
apache-log4j2 (2.12.3-0+deb9u1) stretch-security; urgency=high
.
* Team upload.
* Fix CVE-2020-9488:
Improper validation of certificate with host mismatch in Apache Log4j SMTP
appender. This could allow an SMTPS connection to be intercepted by a
man-in-the-middle attack which could leak any log messages sent through
that appender.
* Fix CVE-2021-45105:
Apache Log4j2 did not protect from uncontrolled recursion from
self-referential lookups. This allows an attacker with control over Thread
Context Map data to cause a denial of service when a crafted string is
interpreted.
Files:
e77c2bd23e10d21abec2ab7c7d381b4c 3024 java optional apache-log4j2_2.12.3-0+deb9u1.dsc
e8997d9a59f23c9d6678841040232dcb 1118852 java optional apache-log4j2_2.12.3.orig.tar.xz
0f8b318a775f1c31c335ff4d5b11abd0 6748 java optional apache-log4j2_2.12.3-0+deb9u1.debian.tar.xz
6624af9a160662c7932770ab6e52fc5e 17215 java optional apache-log4j2_2.12.3-0+deb9u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKjBAEBCgCNFiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmHI03NfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQPHGFwb0BkZWJp
YW4ub3JnAAoJENmtFLlRO1HktxsP/R6OcPVjOLWCzqWk+S2NtPuWkZ4dzvYJmseM
79lZCdaaRF9U99b0451tutPn1lIyprKOV+O+PP6kguiyDHJ0hjqOQXzs2F3vly9Y
qGcv4B/g5UyjlKpz4wJOJdQDxxPqhKuvIkJd2yDT3Y0X7ybYnaD3QFf+cTKMIPa5
0FpI12VhXTHSgF69Wq8YAX+U9VaMp/G4ybj1Q76rPHW4mB48bszHx7Zid1hGLiNO
kjrgecYugf/LbmQtS28nqz594niQIE6hr5eL6zvd5D8csQlBeT6QtaUnYu4yIfFo
n1awEkiwhi++jCY2g0009aIrS2gPw/ZdPg/JDBJBIVWr81G2pZ+TLOXsyRJhbAXK
oNWxrWmWqzkHdMGAg+fC4jgSe9h40Oo1SYEMXxww4vUPl3vgYwpH7Q8Nln38YyV9
MLKd6u48a5u7AUii9tkkJNcHyCbfy3Fq5hryIXABlDeO5rOzLCjd3yvNvMdmOTHV
kN2tB0ewoMNaF6j3KZoGSrPrBoZHbBBKWQFXM2viX4W5c2oKm0j1Kyzz/uB21ls1
f7DrxL7kpfSU3rRbqidlTieYDmulQU7vYl/9PzqaRJjiJmHNDqs3e1yeg3QfC6Q0
pDQOqNvpOZf9jxVuZUaNh6qoY118JL8WurwWuYdyMySBrSb5XOAjOJVxCU660kb+
GT2VSzFo
=rvOm
-----END PGP SIGNATURE-----