Java Buildpack v4.44
I'm pleased to announce the release of the java-buildpack, version 4.44. This release focuses on dependency updates, primarily that fix the Apache Log4j2 vulnerability, CVE-2021-44228, in dependencies used by the Java buildpack.
- Fixed case in networkzone query parameter (@arthfl via #915)
- In particular, the following dependencies were known to be vulnerable to CVE-2021-44228 & have been patched in this release:
- AppDynamics Java Agent
- Elastic APM Java Agent
- New Relic Java Agent
- Geode Tomcat Session Store
If you are using an online version of the Java buildpack you do not strictly need this update, as the online buildpack will always pick the latest version of dependencies.
For a more detailed look at the changes in 4.44, please take a look at the commit log. The packaged version of the buildpack, suitable for use with create-buildpack and update-buildpack, can be found attached to this release.
Packaged Dependencies
| Dependency | Version | CVEs | Release Notes |
|---|---|---|---|
| AppDynamics Agent | 21.11.1_33280 |
Release Notes | |
| Azure Application Insights Agent | 2.6.2 |
Release Notes | |
| CA Introscope APM Framework | 21.11.0_20 |
||
| Client Certificate Mapper | 1.11.0_RELEASE |
Included inline above | Included inline above |
| Container Security Provider | 1.19.0_RELEASE |
Included inline above | Included inline above |
| Contrast Security Agent | 3.8.11_23624 |
Release Notes | |
| Datadog APM Javaagent | 0.91.0 |
Release Notes | |
| Elastic APM Agent | 1.28.1 |
Release Notes | |
| Gemalto Luna Security Provider | 7.4.0 |
Release Notes | |
| Gemalto ProtectApp Security Provider | 8.4.0 |
||
| Geode Tomcat Session Store | 1.13.4 |
||
| Google Stackdriver Debugger | 2.29.0 |
Release Notes | |
| Google Stackdriver Profiler | 0.1.0 |
Release Notes | |
| Groovy | 2.5.15 |
Release Notes | |
| JaCoCo Agent | 0.8.7 |
Release Notes | |
| Java Memory Assistant Agent | 0.5.0 |
||
| Java Memory Assistant Clean Up | 0.1.0 |
||
| JProfiler Profiler | 12.0.4 |
ChangeLog | |
| JRebel Agent | 2021.4.2 |
ChangeLog | |
| jvmkill Agent | 1.16.0_RELEASE |
Included inline above | Included inline above |
| MariaDB JDBC Driver | 2.7.2 |
Release Notes | |
| Memory Calculator | 3.13.0_RELEASE |
Included inline above | Included inline above |
| Metric Writer | 3.5.0_RELEASE |
Included inline above | Included inline above |
| New Relic Agent | 7.4.1 |
Release Notes | |
| OpenJDK JRE | 1.8.0_312 |
Risk Matrix | Release Notes |
| OpenJDK JRE 11 | 11.0.13_8 |
Risk Matrix | Release Notes |
| OpenJDK JRE 17 | 17.0.1_12 |
Risk Matrix | Release Notes |
| PostgreSQL JDBC Driver | 42.3.1 |
ChangeLog | |
| Redis Session Store | 1.3.6_RELEASE |
Included inline above | Included inline above |
| Riverbed Appinternals Agent | 11.8.5_BL527 |
||
| SeaLights Agent | 3.1.2056 |
||
| SkyWalking | 6.6.0 |
ChangeLog | |
| Spring Auto-reconfiguration | 2.12.0_RELEASE |
Included inline above | Included inline above |
| Spring Boot CLI | 2.6.1 |
||
| Spring Boot Container Customizer | 2.6.0_RELEASE |
Included inline above | Included inline above |
| Takipi Agent | 4.63.0 |
Release Notes | |
| Tomcat | 9.0.56 |
Security | ChangeLog |
| Tomcat Access Logging Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| Tomcat Lifecycle Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| Tomcat Logging Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| YourKit Profiler | 2021.11.221 |
Release Notes |
Dependency Notes
- The buildpack is shipping Geode Tomcat Session Store
1.13.4, which uses Apache Geode1.13.5and contains a fix for the Apache Log4j2 vulnerability, CVE-2021-44228. - This version of the buildpack should not be used as it only contains partial fixes for the Log4j2 vulnerabilities. This version includes patches for CVE-2021-44228 for affected 3rd party dependencies (the buildpack itself is not impacted at all) but it does not include patches for CVE-2021-45046. You need version 4.45 of the Java buildpack to be completely patched.
Contributors
arthfl