Changelog for log4j-manual-1.2.17-5.9.1.noarch.rpm :

* Wed Jan 19 2022 fstrbaAATTsuse.com- Remove the chainsaw sub-package (bsc#1194844, CVE-2022-23307)- Remove src/main/java/org/apache/log4j/jdbc/JDBCAppender.java from the build to mitigate bsc#1194843, CVE-2022-23305- Remove src/main/java/org/apache/log4j/net/JMSSink.java from the build to mitigate bsc#1194842, CVE-2022-23302- Obsolete chainsaw < 2.1 by the log4j package- Added patch:
* log4j-missingmodules.patch + do not package org.apache.log4j.chainsaw classes + package org.apache.log4j.pattern classes that will be needed by apache-log4j-extras which is a dependency of chainsaw 2.x
* Thu Dec 16 2021 psimonsAATTsuse.com- Remove src/main/java/org/apache/log4j/net/JMSAppender.java from the build to mitigate CVE-2021-4104. [bsc#1193662]
* Thu Jan 02 2020 pmonrealgonzalezAATTsuse.com- Security fix: [bsc#1159646, CVE-2019-17571]
* Remote code execution: Deserialization of untrusted data in SocketServer
* Backported from CVE-2017-5645 for Log4j 2.8.2- Add log4j-CVE-2019-17571.patch- Use fdupes macro to avoid duplicated files
* Wed Jan 10 2018 bwiedemannAATTsuse.com- Add log4j-reproducible.patch to drop javadoc timestamps to make package builds more reproducible (boo#1047218)
* Tue Sep 12 2017 fstrbaAATTsuse.com- Specify java source and target level 1.6 to allow building with jdk9
* Mon Mar 02 2015 tchvatalAATTsuse.com- Version bump to 1.2.17 latest 1.2 series:
* No short changelog provided - many small changes- Try to avoid cycle between log4j and apache-common-loggings- Remove obsoleted patch:
* log4j-jmx-Agent.patch- Refresh patch to apply to new source:
* log4j-mx4j-tools.patch
* Mon Mar 02 2015 tchvatalAATTsuse.com- Cleanup with a spec-cleaner so I can understand what is going around here.
* Thu Sep 12 2013 mvyskocilAATTsuse.com- log4j and log4j-mini are in conflict
* Mon Sep 09 2013 tchvatalAATTsuse.com- Move from jpackage-utils to javapackage-tools
* Tue Jul 16 2013 mlsAATTsuse.de- get rid of wrong dir modifier in filelist