log4j

Fork of Apache log4j with security fixes.

A new fork reload4j seems a better option and a better place to join forces to maintain a secure version of log4j 1.

https://github.com/qos-ch/reload4j

Get with maven

<dependency>
    <groupId>com.github.albfernandez</groupId>
    <artifactId>log4j</artifactId>
    <version>1.2.18.ayg04</version>
</dependency>

Changes from 1.2.17

Fixes for security vulnerabilities
- CVE-2017-5645. Remote code execution using the TCP socket server or UDP socket server
- CVE-2019-17571. SocketServer class that is vulnerable to deserialization of untrusted data
- CVE-2020-9488. Improper validation of certificate with host mismatch in Apache Log4j SMTP appender.
- CVE-2020-9493. Deserialization flaw was found in Apache Chainsaw (Removed chainsaw).
- CVE-2021-4104. Deserialization of untrusted data in JMSAppender (Removed JMSAppender.java and related JMS stuff)
- CVE-2022-23302. Deserialization of untrusted data in JMSSink (Removed JMSSink.java and related JMS stuff)
- CVE-2022-23307. Deserialization flaw was found in Apache Chainsaw (Removed chainsaw).
- CVE-2022-23305 SQL injection in JDBCAppender
- CVE-2023-26464 (Not afected beacuse this is compiled for 1.8 and cannot be run in JRE lower than 1.8)
- Prevent XXE attacks.
Removed NTEventLogAppender.
Removed Chainsaw.
Removed lf5.
Removed jmx.
Java 11, 17 and 21 support.
Compiled for Java 8.
Published in maven central