From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Till Hofmann To: git-commits@fedoraproject.org Subject: [rpms/log4cxx] epel8: Backport fix for CVE-2025-54812 (HTMLLayout logger-name XSS) Date: Fri, 03 Jul 2026 11:23:04 GMT Message-ID: <178307778401.1.10358718087171436814.rpms-log4cxx-d46dcae082b4@fedoraproject.org> List-ID: X-Git-Repo: rpms/log4cxx X-Git-Branch: epel8 X-Git-Rev: d46dcae082b4a5517ac2b467ffc50907d4d56440 ICAgICAgICAgICAgQSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KCiAgICAgICAgICAgIFJl cG8gICA6IHJwbXMvbG9nNGN4eAogICAgICAgICAgICBCcmFuY2ggOiBlcGVsOAogICAgICAgICAg ICBDb21taXQgOiBkNDZkY2FlMDgyYjRhNTUxN2FjMmI0NjdmZmM1MDkwN2Q0ZDU2NDQwCiAgICAg ICAgICAgIEF1dGhvciA6IFRpbGwgSG9mbWFubiA8dGhvZm1hbm5AZmVkb3JhcHJvamVjdC5vcmc+ CiAgICAgICAgICAgIERhdGUgICA6IDIwMjYtMDctMDNUMTI6NDc6MDcrMDI6MDAKICAgICAgICAg ICAgU3RhdHMgIDogKzgzLy0xIGluIDIgZmlsZShzKQogICAgICAgICAgICBVUkwgICAgOiBodHRw czovL3NyYy5mZWRvcmFwcm9qZWN0Lm9yZy9ycG1zL2xvZzRjeHgvYy9kNDZkY2FlMDgyYjRhNTUx N2FjMmI0NjdmZmM1MDkwN2Q0ZDU2NDQwP2JyYW5jaD1lcGVsOAoKICAgICAgICAgICAgTG9nOgog ICAgICAgICAgICBCYWNrcG9ydCBmaXggZm9yIENWRS0yMDI1LTU0ODEyIChIVE1MTGF5b3V0IGxv Z2dlci1uYW1lIFhTUykKCkhUTUxMYXlvdXQgd3JvdGUgdGhlIGxvZ2dlciBuYW1lIHVuZXNjYXBl ZCBpbnRvIGFuIEhUTUwgdGl0bGU9Ii4uLiIKYXR0cmlidXRlLiBJZiB1bnRydXN0ZWQgZGF0YSBj b250cm9scyB0aGUgbG9nZ2VyIG5hbWUsIHRoaXMgYWxsb3dzCmJyZWFraW5nIG91dCBvZiB0aGUg YXR0cmlidXRlIGFuZCBpbmplY3RpbmcgSFRNTC9KUyBpbnRvIHRoZQpnZW5lcmF0ZWQgbG9nIGZp bGUsIHdoaWNoIGV4ZWN1dGVzIHdoZW4gb3BlbmVkIGluIGEgYnJvd3Nlci4KCkJhY2twb3J0cyB0 aGUgZXNjYXBpbmcgZml4IGZyb20gdXBzdHJlYW0gY29tbWl0IGQ2MTdmMGMwMCAocGFydCBvZgp0 aGUgMS41LjAgcmVsZWFzZSkgdG8gdGhpcyBwYWNrYWdlJ3MgMC4xMC4wIGJhc2UgYnkgYWRkaW5n ClRyYW5zZm9ybTo6YXBwZW5kRXNjYXBpbmdRdW90ZSgpIGFuZCB1c2luZyBpdCBmb3IgdGhlIGxv Z2dlciBuYW1lIGluCkhUTUxMYXlvdXQ6OmZvcm1hdCgpLiBWYWxpZGF0ZWQgbG9jYWxseTogcGF0 Y2ggYXBwbGllcyBjbGVhbmx5LApidWlsZHMgd2l0aG91dCBlcnJvcnMgdW5kZXIgbW9jayAocm9j a3krZXBlbC04LXg4Nl82NCksIGFuZCBhIG1hbnVhbApydW50aW1lIHRlc3QgY29uZmlybXMgYSBs b2dnZXIgbmFtZSBjb250YWluaW5nIGEgZG91YmxlIHF1b3RlIGlzIG5vdwpyZW5kZXJlZCBhcyAm cXVvdDsgaW5zdGVhZCBvZiBicmVha2luZyBvdXQgb2YgdGhlIGF0dHJpYnV0ZS4KCk5vdCBwdXNo ZWQ7IGxvY2FsIHZhbGlkYXRpb24gb25seS4KCkNvLUF1dGhvcmVkLUJ5OiBDbGF1ZGUgU29ubmV0 IDUgPG5vcmVwbHlAYW50aHJvcGljLmNvbT4KCi0tLQpkaWZmIC0tZ2l0IGEvbG9nNGN4eC0wLjEw LjAtQ1ZFLTIwMjUtNTQ4MTItaHRtbGxheW91dC1xdW90ZS1lc2NhcGUucGF0Y2ggYi9sb2c0Y3h4 LTAuMTAuMC1DVkUtMjAyNS01NDgxMi1odG1sbGF5b3V0LXF1b3RlLWVzY2FwZS5wYXRjaApuZXcg ZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi4yMjY1ZDBhCi0tLSAvZGV2L251bGwKKysr IGIvbG9nNGN4eC0wLjEwLjAtQ1ZFLTIwMjUtNTQ4MTItaHRtbGxheW91dC1xdW90ZS1lc2NhcGUu cGF0Y2gKQEAgLTAsMCArMSw3MyBAQAorLS0tIGEvc3JjL21haW4vY3BwL2h0bWxsYXlvdXQuY3Bw CTIwMjYtMDctMDMgMTI6MzY6MzguMzgxNzQ5NjMyICswMjAwCisrKysgYi9zcmMvbWFpbi9jcHAv aHRtbGxheW91dC5jcHAJMjAyNi0wNy0wMyAxMjozNjo0OS4wNzM4NTcxODQgKzAyMDAKK0BAIC0x MDUsNyArMTA1LDcgQEAKKyAgICAgICAgIG91dHB1dC5hcHBlbmQoTE9HNENYWF9FT0wpOworIAor ICAgICAgICAgb3V0cHV0LmFwcGVuZChMT0c0Q1hYX1NUUigiPHRkIHRpdGxlPVwiIikpOworLSAg ICAgICAgb3V0cHV0LmFwcGVuZChldmVudC0+Z2V0TG9nZ2VyTmFtZSgpKTsKKysgICAgICAgIFRy YW5zZm9ybTo6YXBwZW5kRXNjYXBpbmdRdW90ZShvdXRwdXQsIGV2ZW50LT5nZXRMb2dnZXJOYW1l KCkpOworICAgICAgICAgb3V0cHV0LmFwcGVuZChMT0c0Q1hYX1NUUigiIGxvZ2dlclwiPiIpKTsK KyAgICAgICAgIFRyYW5zZm9ybTo6YXBwZW5kRXNjYXBpbmdUYWdzKG91dHB1dCwgZXZlbnQtPmdl dExvZ2dlck5hbWUoKSk7CisgICAgICAgICBvdXRwdXQuYXBwZW5kKExPRzRDWFhfU1RSKCI8L3Rk PiIpKTsKKy0tLSBhL3NyYy9tYWluL2NwcC90cmFuc2Zvcm0uY3BwCTIwMjYtMDctMDMgMTI6MzY6 MzguMzgxNjY0NzM4ICswMjAwCisrKysgYi9zcmMvbWFpbi9jcHAvdHJhbnNmb3JtLmNwcAkyMDI2 LTA3LTAzIDEyOjM3OjI3LjkwNjk0OTQ5MiArMDIwMAorQEAgLTExNSwzICsxMTUsNDAgQEAKKyAg ICBidWYuYXBwZW5kKGlucHV0LCBzdGFydCwgaW5wdXQubGVuZ3RoKCkgLSBzdGFydCk7CisgfQor IAorK3ZvaWQgVHJhbnNmb3JtOjphcHBlbmRFc2NhcGluZ1F1b3RlKAorKyAgIExvZ1N0cmluZyYg YnVmLCBjb25zdCBMb2dTdHJpbmcmIGlucHV0KQorK3sKKysgICBzdGF0aWMgY29uc3QgTG9nU3Ry aW5nIFFVT1RFKExPRzRDWFhfU1RSKCJcIiIpKTsKKysgICBzdGF0aWMgY29uc3QgTG9nU3RyaW5n IFFVT1RFX0VOVElUWShMT0c0Q1hYX1NUUigiJnF1b3Q7IikpOworKworKyAgIGlmKGlucHV0Lmxl bmd0aCgpID09IDAgKQorKyAgIHsKKysgICAgICByZXR1cm47CisrICAgfQorKworKyAgIExvZ1N0 cmluZzo6c2l6ZV90eXBlIGVuZCA9IGlucHV0LmZpbmQoUVVPVEUpOworKyAgIGlmIChlbmQgPT0g TG9nU3RyaW5nOjpucG9zKQorKyAgIHsKKysgICAgICBidWYuYXBwZW5kKGlucHV0KTsKKysgICAg ICByZXR1cm47CisrICAgfQorKworKyAgIExvZ1N0cmluZzo6c2l6ZV90eXBlIHN0YXJ0ID0gMDsK KysgICB3aGlsZSAoZW5kICE9IExvZ1N0cmluZzo6bnBvcykKKysgICB7CisrICAgICAgYnVmLmFw cGVuZChpbnB1dCwgc3RhcnQsIGVuZC1zdGFydCk7CisrICAgICAgYnVmLmFwcGVuZChRVU9URV9F TlRJVFkpOworKyAgICAgIHN0YXJ0ID0gZW5kICsgMTsKKysgICAgICBpZiAoc3RhcnQgPCBpbnB1 dC5sZW5ndGgoKSkKKysgICAgICB7CisrICAgICAgICAgZW5kID0gaW5wdXQuZmluZChRVU9URSwg c3RhcnQpOworKyAgICAgIH0KKysgICAgICBlbHNlCisrICAgICAgeworKyAgICAgICAgIHJldHVy bjsKKysgICAgICB9CisrICAgfQorKworKyAgIGJ1Zi5hcHBlbmQoaW5wdXQsIHN0YXJ0LCBpbnB1 dC5sZW5ndGgoKSAtIHN0YXJ0KTsKKyt9CisrCistLS0gYS9zcmMvbWFpbi9pbmNsdWRlL2xvZzRj eHgvaGVscGVycy90cmFuc2Zvcm0uaAkyMDI2LTA3LTAzIDEyOjM2OjM4LjM4NDA1NTEyNSArMDIw MAorKysrIGIvc3JjL21haW4vaW5jbHVkZS9sb2c0Y3h4L2hlbHBlcnMvdHJhbnNmb3JtLmgJMjAy Ni0wNy0wMyAxMjozNzozOS45MDA5NzgwMDQgKzAyMDAKK0BAIC01NSw2ICs1NSwxNiBAQAorICAg ICAgICAgICAgICAgICAgICAgICAgICovCisgICAgICAgICAgICAgICAgICAgICAgICAgc3RhdGlj IHZvaWQgYXBwZW5kRXNjYXBpbmdDREFUQSgKKyAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIExvZ1N0cmluZyYgYnVmLCBjb25zdCBMb2dTdHJpbmcmIGlucHV0KTsKKysKKysgICAgICAg ICAgICAgICAgICAgICAgICAvKioKKysgICAgICAgICAgICAgICAgICAgICAgICAqIEFkZCBcYyBp bnB1dCB0byBcYyBidWYgd2l0aCBkb3VibGUgcXVvdGUgY2hhcmFjdGVycyByZXBsYWNlZCB3aXRo CisrICAgICAgICAgICAgICAgICAgICAgICAgKiAmYW1wO3F1b3Q7LgorKyAgICAgICAgICAgICAg ICAgICAgICAgICoKKysgICAgICAgICAgICAgICAgICAgICAgICAqIEBwYXJhbSBidWYgb3V0cHV0 IHN0cmVhbSBob2xkaW5nIHRoZSBkYXRhIHRvIHRoaXMgcG9pbnQuCisrICAgICAgICAgICAgICAg ICAgICAgICAgKiBAcGFyYW0gaW5wdXQgVGhlIHRleHQgdG8gYmUgY29udmVydGVkLgorKyAgICAg ICAgICAgICAgICAgICAgICAgICovCisrICAgICAgICAgICAgICAgICAgICAgICAgc3RhdGljIHZv aWQgYXBwZW5kRXNjYXBpbmdRdW90ZSgKKysgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IExvZ1N0cmluZyYgYnVmLCBjb25zdCBMb2dTdHJpbmcmIGlucHV0KTsKKyAgICAgICAgICAgICAg ICAgfTsgLy8gY2xhc3MgVHJhbnNmb3JtCisgICAgICAgICB9ICAvLyBuYW1lc3BhY2UgaGVscGVy cworIH0gLy9uYW1lc3BhY2UgbG9nNGN4eAoKZGlmZiAtLWdpdCBhL2xvZzRjeHguc3BlYyBiL2xv ZzRjeHguc3BlYwppbmRleCBkOWJiY2JjLi40NDcwYmU4IDEwMDY0NAotLS0gYS9sb2c0Y3h4LnNw ZWMKKysrIGIvbG9nNGN4eC5zcGVjCkBAIC0xLDYgKzEsNiBAQAogTmFtZTogbG9nNGN4eAogVmVy c2lvbjogMC4xMC4wCi1SZWxlYXNlOiAzMSV7P2Rpc3R9CitSZWxlYXNlOiAzMiV7P2Rpc3R9CiBT dW1tYXJ5OiBBIHBvcnQgdG8gQysrIG9mIHRoZSBMb2c0aiBwcm9qZWN0CiAKIExpY2Vuc2U6IEFT TCAyLjAKQEAgLTEzLDYgKzEzLDEwIEBAIFBhdGNoMDogbG9nNGN4eC1jc3RyaW5nLnBhdGNoCiAj IGh0dHBzOi8vYW5vbnNjbS5kZWJpYW4ub3JnL2NnaXQvY29sbGFiLW1haW50L2xvZzRjeHguZ2l0 L3BsYWluL2RlYmlhbi9wYXRjaGVzLzE3MC1nY2M2LWZpeC5wYXRjaAogUGF0Y2gxOiBsb2c0Y3h4 LWdjYzYucGF0Y2gKIFBhdGNoMjogbG9nNGN4eC1nY2M2LXRlc3RzLnBhdGNoCisjIEZpeGVzIENW RS0yMDI1LTU0ODEyOiBIVE1MTGF5b3V0IGRpZCBub3QgZXNjYXBlIGRvdWJsZSBxdW90ZXMgaW4g dGhlCisjIGxvZ2dlciBuYW1lIHdyaXR0ZW4gaW50byB0aGUgSFRNTCB0aXRsZT0iLi4uIiBhdHRy aWJ1dGUsIGJhY2twb3J0ZWQKKyMgZnJvbSB1cHN0cmVhbSBjb21taXQgZDYxN2YwYzAwIChmaXhl ZCB1cHN0cmVhbSBpbiAxLjUuMCkKK1BhdGNoMzogbG9nNGN4eC0wLjEwLjAtQ1ZFLTIwMjUtNTQ4 MTItaHRtbGxheW91dC1xdW90ZS1lc2NhcGUucGF0Y2gKIAogQnVpbGRSZXF1aXJlczogYXByLWRl dmVsCiBCdWlsZFJlcXVpcmVzOiBhcHItdXRpbC1kZXZlbApAQCAtNDYsNiArNTAsNyBAQCBEb2N1 bWVudGF0aW9uIGZvciAle25hbWV9LgogJXBhdGNoMCAtcDEKICVwYXRjaDEgLXAxCiAlcGF0Y2gy IC1wMQorJXBhdGNoMyAtcDEKIAogJWJ1aWxkCiBzZWQgLWkubGliZGlyX3N5c3NlYXJjaCAtZSBc CkBAIC03OCw2ICs4MywxMCBAQCBybSAkUlBNX0JVSUxEX1JPT1QvJXtfbGliZGlyfS9saWJsb2c0 Y3h4LmxhCiAlZG9jIGh0bWwvCiAKICVjaGFuZ2Vsb2cKKyogRnJpIEp1bCAwMyAyMDI2IFRpbGwg SG9mbWFubiA8dGlsbC5ob2ZtYW5uQHBvc3Rlby5kZT4gLSAwLjEwLjAtMzIKKy0gQmFja3BvcnQg Zml4IGZvciBDVkUtMjAyNS01NDgxMiAoSFRNTExheW91dCBsb2dnZXIgbmFtZSBub3QgZXNjYXBl ZCwKKyAgcG9zc2libGUgWFNTIGluIGdlbmVyYXRlZCBIVE1MIGxvZyBmaWxlcykKKwogKiBUdWUg SnVsIDI4IDIwMjAgRmVkb3JhIFJlbGVhc2UgRW5naW5lZXJpbmcgPHJlbGVuZ0BmZWRvcmFwcm9q ZWN0Lm9yZz4gLSAwLjEwLjAtMzEKIC0gUmVidWlsdCBmb3IgaHR0cHM6Ly9mZWRvcmFwcm9qZWN0 Lm9yZy93aWtpL0ZlZG9yYV8zM19NYXNzX1JlYnVpbGQKIAo=