fix: replace log4j by reload4j to fix vulnerability

See https://reload4j.qos.ch The reload4j project is a fork of Apache log4j version 1.2.17 with the goal of fixing pressing security issues. Reload4j is a binary compatible, drop-in replacement for log4j version 1.2.17 Fix #7
daisy · Jun 19, 2023 · 5ddce3a · 5ddce3a
1 parent 4214a09
commit 5ddce3a
Show file tree

Hide file tree

Showing 8 changed files with 6 additions and 6 deletions.
diff --git a/META-INF/MANIFEST.MF b/META-INF/MANIFEST.MF
@@ -18,7 +18,7 @@ Bundle-ClassPath:
   lib/epubcheck-3.0.jar,
  lib/icu4j-3_8.jar,
  lib/jl1.0.jar,
- lib/log4j-1.2.15.jar,
+ lib/reload4j-1.2.25.jar,
  lib/louisFat.jar,
  lib/jing.jar,
  lib/xml-apis.jar,

diff --git a/build-addin.xml b/build-addin.xml
@@ -38,7 +38,7 @@
 			<include name="epubcheck-3.0.jar"/>
 			<include name="icu4j-72_1.jar"/>		
 			<include name="jl1.0.jar"/>
-			<include name="log4j-1.2.15.jar"/>
+			<include name="reload4j-1.2.25.jar"/>
 			<include name="jing.jar"/>
 			<include name="xml-apis.jar"/>
 			<include name="sac.jar"/>

diff --git a/build-core.xml b/build-core.xml
@@ -39,7 +39,7 @@
 		<include name="jaudiotagger.jar"/>
 		<include name="jl1.0.jar"/>
 		<include name="junit-4.7.jar"/>
-		<include name="log4j-1.2.15.jar"/>
+		<include name="reload4j-1.2.25.jar"/>
 		<include name="jing.jar"/>
 		<include name="xml-apis.jar"/>
 		<include name="sac.jar"/>

diff --git a/build-deb.xml b/build-deb.xml
@@ -49,7 +49,7 @@
 	<include name="jaudiotagger.jar"/>
 	<include name="jl1.0.jar"/>
 	<include name="junit-4.7.jar"/>
-	<include name="log4j-1.2.15.jar"/>
+	<include name="reload4j-1.2.25.jar"/>
 	<include name="jing.jar"/>
 	<include name="xml-apis.jar"/>
 	<include name="sac.jar"/>

diff --git a/build-odt-addin.xml b/build-odt-addin.xml
@@ -24,7 +24,7 @@
 			<include name="epubcheck-3.0.jar"/>
 			<include name="icu4j-72_1.jar"/>	
 			<include name="jl1.0.jar"/>
-			<include name="log4j-1.2.15.jar"/>
+			<include name="reload4j-1.2.25.jar"/>
 			<include name="jing.jar"/>
 			<include name="xml-apis.jar"/>
 			<include name="sac.jar"/>

diff --git a/lib/log4j-1.2.15.jar b/lib/log4j-1.2.15.jar
diff --git a/lib/reload4j-1.2.25.jar b/lib/reload4j-1.2.25.jar
diff --git a/licenses/UserAgreement.txt b/licenses/UserAgreement.txt
@@ -79,7 +79,7 @@ with the DAISY Pipeline application are listed below:
 	GNU Lesser General Public License
 	http://www.gnu.org/licenses/lgpl.html
 
-	log4j-1.2.15.jar
+	reload4j-1.2.25
 	Logging library
 	Apache Software License, Version 2
 	http://www.apache.org/licenses/