[From nobody Thu Oct 15 23:43:12 2026 Received: (at 1141960-close) by bugs.debian.org; 15 Oct 2026 22:41:21 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-113.7 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FVGT_m_MULTI_ODD, HAS_BUG_NUMBER,MD5_SHA1_SUM,PDS_BTC_ID,PGPSIGNATURE,SPF_HELO_PASS, SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 13; hammy, 150; neutral, 301; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:49796) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xHU8X-00CBeY-2H for 1141960-close@bugs.debian.org; Thu, 15 Oct 2026 22:41:21 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xHU8W-0070kz-1P for 1141960-close@bugs.debian.org; Thu, 15 Oct 2026 22:41:20 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=OH2hyzO4nH3zT9w2qrlGcKbT9/8Ad4GnXtIAd5SXduI=; b=DJLk5CVh1Pav+W1qblx3FJn0H5 rE11eI+UIthSZpFiKX0q01VrLIghLpxsnOgkg7CzNGQEjqMvzDYiZ+h4OyrPbtJECzdSYdmFT6pKM jiWKBAzQN8lmUbE6mpqpzaXru+t0SGQjUaR5+7HPtCrMZF5p5A15m1pTpJSrm2eovtJL/sS9jftQZ DwSQ0s1M6K25rnbdqMAnwcQNca6YBAZqT74zf4ohqEQG38zpu5TGQnVZLNQ8749ZJltIONGmG5p8G n+aRwYwc2+QTGP3BufGNlfa++o8LsZ+OX6Yovgwqo7ibUbrMg2d2fEtN34ICZBSamp2Pr8wjC9LLZ sYRtMQxw==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1xHU8V-00000004aCD-2dJj; Thu, 15 Oct 2026 22:41:19 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Emmanuel Bourg <ebourg@apache.org> To: 1141960-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: apache-log4j2 Debian: DAK Debian-Changes: apache-log4j2_2.26.1-1_source.changes Debian-Source: apache-log4j2 Debian-Version: 2.26.1-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1141960: fixed in apache-log4j2 2.26.1-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============7709663436277552134==" Message-Id: <E1xHU8V-00000004aCD-2dJj@fasolo.debian.org> Date: Thu, 15 Oct 2026 22:41:19 +0000 X-CrossAssassin-Score: 4 --===============7709663436277552134== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: apache-log4j2 Source-Version: 2.26.1-1 Done: Emmanuel Bourg <ebourg@apache.org> We believe that the bug you reported is fixed in the latest version of apache-log4j2, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1141960@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Emmanuel Bourg <ebourg@apache.org> (supplier of updated apache-log4j2 package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 16 Oct 2026 00:22:08 +0200 Source: apache-log4j2 Architecture: source Version: 2.26.1-1 Distribution: unstable Urgency: medium Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian= .org> Changed-By: Emmanuel Bourg <ebourg@apache.org> Closes: 1109751 1123744 1133846 1133847 1133848 1141960 Changes: apache-log4j2 (2.26.1-1) unstable; urgency=3Dmedium . * Team upload. . [ tony mancill ] * New upstream version 2.26.1 Addresses the following CVEs: - CVE-2025-68161 (Closes: #1123744) - CVE-2026-34479 (Closes: #1133848) - CVE-2026-34480 (Closes: #1133847) - CVE-2026-34481 (Closes: #1133846) - CVE-2026-49844 (Closes: #1141960) * Exclude Build-Depends: groovy (Closes: #1109751) Thank you to Bastian Germann for the patch. * Add libjspecify to Build-Depends * Drop MongoDB appender support (log4j-mongodb) until a newer version of the MongoDB driver (libmongodb-java) is available. * Update Debian poms for added/removed modules in upstream 2.26.1 * Update debian/rules to set POM revision property to upstream package ver= sion * Update d/maven.rules and ignoreRules for new upstream release * Freshen and add patches needed for new upstream release * Bump Standards-Version to 4.7.4 . [ Emmanuel Bourg ] * Removed the Priority field * Converted debian/watch to the version 5 format Checksums-Sha1: 4966ab762d538660fe35a4715fd921e217804fcb 2907 apache-log4j2_2.26.1-1.dsc 2b1231ddc0725f19038ceb7c0d1a211eb147e3f3 1551040 apache-log4j2_2.26.1.orig.t= ar.xz ef2fb65d208fbc9ded85030d6abe4f111afac92e 10848 apache-log4j2_2.26.1-1.debian= .tar.xz 5afb3c6afd9cc5a71ab8d058dc563eec61142668 16031 apache-log4j2_2.26.1-1_source= .buildinfo Checksums-Sha256: 9df9cc67b8abdc1dc76ab729f8655c78cece7ab12a0ecc798e7567019c89339e 2907 apache= -log4j2_2.26.1-1.dsc aa9007f3f03c838d008f43b6e165955a1ef6f258ad0c91366bac2dda74ce29fa 1551040 apa= che-log4j2_2.26.1.orig.tar.xz 8b2935e05cd5c19372306eabcf02ae96012b168e79c2e9fe38852226c25c5df9 10848 apach= e-log4j2_2.26.1-1.debian.tar.xz 90c46b6accbc099bc02a8aaaeb2f49ac8e1e66fc1dd8a405c89d188d01581184 16031 apach= e-log4j2_2.26.1-1_source.buildinfo Files: 0df3b46099fed287028f50aac4b9f2f2 2907 java optional apache-log4j2_2.26.1-1.d= sc 10273152b26afa5a289d6e8f7f17d008 1551040 java optional apache-log4j2_2.26.1.= orig.tar.xz 3df1e64eb457c6151c14fe2dd5943c28 10848 java optional apache-log4j2_2.26.1-1.= debian.tar.xz a7a09b805636c8a48235851c1c46e193 16031 java optional apache-log4j2_2.26.1-1_= source.buildinfo -----BEGIN PGP SIGNATURE----- iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmrRUkkSHGVib3VyZ0Bh cGFjaGUub3JnAAoJEPUTxBnkudCsqZEP/jxWo4B9qsr8rP5osHmv/DWT1nDyEtYs ZTDpQt78B4opRXMnvqHhfEa39XB1mJSkbgEDBHiBTjrCjZYNiLRXpYd7kvk2gMzV uSYKGNjTpfyNnZvr1AEzAZi+o0+DpdVGXIrCVIE4l/yjas3zC3tFc8BmCAYr3m1O ve/V8ZgOOHe3Fa5F7ovWrRaXpC1E+SUz7R0jKQjXy6kU5CSgfQsVPxBQs+Hfv+wp sz6Vw5ayxUjYlXjc8OI6c/w/FNoIE38KHgpFfVnJxAOmB4lH8aFiahx5BItz6AZD HS54e3q45uaJzQKZo+XuAwV/xxTerRkQtiDkPhN/yxGYOksG86Fmxb32JN2oW7ip HZyQJCwMTxO5/Zw2A0F+oxo7d9humN11Ql/2c+Vz1FsYb1UQU34TKKaNzWnq01L7 4mRuRnEDMMf/FfchqxyvxI1z8KeMZJtf4PkOx0Krx3iRZz6Gl2jft2cIkTAEVcmB O0QWGWPCTuonmybyvBk8BR1wBzOoARFPyxkXnoUjWX5LtdO9WPcXl/BghGbYuLJb UrR77BU8GGIFwZ/gGHv4hjsBzE5ITCMDxLbdCdsNi2lokQfZM7M+TVW98RFdJfYh 2IwzoyJuGnqW82svZkaiBbGKg45bpbYR0Ygd42rdLXzY8JpIt3+v1w1IPGZOmpzr UnbiYZ9+od/F =3DMCpb -----END PGP SIGNATURE----- --===============7709663436277552134== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCatFWjwAKCRCb9qggYcy5 IcezAQC9fWlb+qjsNd53jAGZl68V/SVM+fji4ntBFfymKZwrkQD+P5rDqnYUYgHm JRfiubxllCIHtw6jJ8yvj49Y+m6RyQg= =eVnH -----END PGP SIGNATURE----- --===============7709663436277552134==-- ]