Skip to content

Release v1.8.1 #292

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Dec 20, 2021
Merged

Release v1.8.1 #292

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
83a24c8
Update README.md
bxsx Dec 19, 2021
840d31c
Release v1.8.1
bxsx Dec 19, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
# Change Log

# 1.8.1

- Update log4j dependencies to v2.17.0 to fix CVE-2021-45105 [#291](https://github.com/rollbar/rollbar-java/pull/291)

# 1.8.0

- Update log4j dependencies to v 2.16.0 (#287)
Expand Down
2 changes: 1 addition & 1 deletion gradle.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
VERSION_NAME=1.8.1-SNAPSHOT
VERSION_NAME=1.8.1
GROUP=com.rollbar

POM_DESCRIPTION=For connecting your applications built on the JVM to Rollbar for Error Reporting
Expand Down
22 changes: 15 additions & 7 deletions rollbar-log4j2/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,28 +1,36 @@
# Rollbar Log4j 2 integration

This directory contains the Log4j 2 integration of the Rollbar Java SDK.
This directory contains the Log4j 2 integration of the Rollbar Java SDK.

Instructions for building and contributing to the SDK can be found in the main repository [README](../README.md).

## Compatibility

Staring with version `1.8.0`, `rollbar-log4j2` depends on version `2.16.0` of `log4j-core`. This removes compatibility with Java 7, but was a necessary upgrade to fix the CVE-2021-44228 vulnerability in Log4j.
Staring with version `1.8.0`, `rollbar-log4j2` depends on version `2.16.0` (or later) of `log4j-core`.
This removes compatibility with Java 7, but was a necessary upgrade to fix the following vulnerabilites in Log4j:

Projects built and / or running with Java 7 can still use `rollbar-log4j2` version `1.8.0`, while forcing the use of a **vulnerable**, Java 7 compatible version of `Log4j`, by updating their build configuration to ignore transitive dependencies from `rollbar-log4j2`.
- CVE-2021-44228
- CVE-2021-45046
- CVE-2021-45105

Projects built and/or running with Java 7 can still use `rollbar-log4j2` version `1.8.0+`,
while forcing the use of a **vulnerable**, Java 7 compatible version of `Log4j`,
by updating their build configuration to ignore transitive dependencies from `rollbar-log4j2`.

Gradle configuration:

```gradle
dependencies {
implementation(group: 'com.rollbar', name: 'rollbar-log4j2', version: '1.8.0') {
implementation(group: 'com.rollbar', name: 'rollbar-log4j2', version: '1.8.1') {
exclude group: 'org.apache.logging.log4j'
}

implementation group: 'org.apache.logging.log4j', name: 'log4j-slf4j-impl', version: '2.12.1'
annotationProcessor group: 'org.apache.logging.log4j', name: 'log4j-core', version: '2.12.1'
implementation group: 'org.apache.logging.log4j', name: 'log4j-slf4j-impl', version: '2.12.2'
annotationProcessor group: 'org.apache.logging.log4j', name: 'log4j-core', version: '2.12.2'
}

```

Note CVE-2021-44228 is a major RCE vulnerability and this approach should only be used after a thorough security analysis, and with very strong mitigations in place.
While CVE-2021-44228 and CVE-2021-45046 are already fixed in `2.12.2`, CVE-2021-45105 is **not** fixed for Java 7.
Note CVE-2021-45105 is a high DoS vulnerability and this approach should only be used after a thorough security analysis, and with very strong mitigations in place.