Merge pull request #11723 from cmaglie/log4j-2.16

Upgrade Log4j to version 2.16
arduino · Dec 14, 2021 · 6cf3a89 · 6cf3a89
2 parents d7116ee + 1005ab1
commit 6cf3a89
Show file tree

Hide file tree

Showing 8 changed files with 13 additions and 7 deletions.
diff --git a/app/.classpath b/app/.classpath
@@ -38,8 +38,8 @@
 	<classpathentry kind="lib" path="lib/jmdns-3.5.5.jar"/>
 	<classpathentry kind="lib" path="lib/slf4j-api-1.7.22.jar"/>
 	<classpathentry kind="lib" path="lib/slf4j-simple-1.7.22.jar"/>
-	<classpathentry kind="lib" path="lib/log4j-api-2.15.0.jar"/>
-	<classpathentry kind="lib" path="lib/log4j-core-2.15.0.jar"/>
+	<classpathentry kind="lib" path="lib/log4j-api-2.16.0.jar"/>
+	<classpathentry kind="lib" path="lib/log4j-core-2.16.0.jar"/>
 	<classpathentry kind="lib" path="lib/jsch-0.1.50.jar"/>
 	<classpathentry kind="lib" path="lib/rsyntaxtextarea-3.0.3-SNAPSHOT.jar"/>
 	<classpathentry kind="lib" path="lib/xml-apis-1.3.04.jar"/>

diff --git a/app/lib/log4j-api-2.15.0.jar → app/lib/log4j-api-2.16.0.jar b/app/lib/log4j-api-2.15.0.jar → app/lib/log4j-api-2.16.0.jar
diff --git a/app/lib/log4j-core-2.15.0.jar → app/lib/log4j-core-2.16.0.jar b/app/lib/log4j-core-2.15.0.jar → app/lib/log4j-core-2.16.0.jar
diff --git a/arduino-core/.classpath b/arduino-core/.classpath
@@ -8,8 +8,8 @@
 	<classpathentry kind="lib" path="lib/jmdns-3.5.5.jar"/>
 	<classpathentry kind="lib" path="lib/slf4j-api-1.7.22.jar"/>
 	<classpathentry kind="lib" path="lib/slf4j-simple-1.7.22.jar"/>
-	<classpathentry kind="lib" path="lib/log4j-api-2.15.0.jar"/>
-	<classpathentry kind="lib" path="lib/log4j-core-2.15.0.jar"/>
+	<classpathentry kind="lib" path="lib/log4j-api-2.16.0.jar"/>
+	<classpathentry kind="lib" path="lib/log4j-core-2.16.0.jar"/>
 	<classpathentry kind="lib" path="lib/jsch-0.1.50.jar"/>
 	<classpathentry kind="lib" path="lib/commons-exec-1.1.jar"/>
 	<classpathentry kind="lib" path="../app/lib/commons-httpclient-3.1.jar"/>

diff --git a/arduino-core/lib/log4j-api-2.15.0.jar → arduino-core/lib/log4j-api-2.16.0.jar b/arduino-core/lib/log4j-api-2.15.0.jar → arduino-core/lib/log4j-api-2.16.0.jar
diff --git a/arduino-core/lib/log4j-core-2.15.0.jar → arduino-core/lib/log4j-core-2.16.0.jar b/arduino-core/lib/log4j-core-2.15.0.jar → arduino-core/lib/log4j-core-2.16.0.jar
diff --git a/arduino-core/src/processing/app/BaseNoGui.java b/arduino-core/src/processing/app/BaseNoGui.java
@@ -41,9 +41,9 @@
 public class BaseNoGui {
 
   /** Version string to be used for build */
-  public static final int REVISION = 10817;
+  public static final int REVISION = 10818;
   /** Extended version string displayed on GUI */
-  public static final String VERSION_NAME = "1.8.17";
+  public static final String VERSION_NAME = "1.8.18";
   public static final String VERSION_NAME_LONG;
 
   // Current directory to use for relative paths specified on the

diff --git a/build/shared/revisions.txt b/build/shared/revisions.txt
@@ -1,4 +1,10 @@
-ARDUINO 1.8.17 2021.12.14 SECURITY HOTFIX RELEASE
+ARDUINO 1.8.18 2021.12.14 SECURITY HOTFIX RELEASE
+
+[ide]
+* Upgrade log4j to 2.16.0 - Extra hardening for CVE-2021-44228
+
+
+ARDUINO 1.8.17 (not released superseded by 1.8.18)
 
 [ide]
 * Upgrade log4j to 2.15.0 - CVE-2021-44228 (thanks @rhowe)