Merge pull request #11723 from cmaglie/log4j-2.16

Upgrade Log4j to version 2.16

8 files changed, 13 insertions, 7 deletions

diff --git a/app/.classpath b/app/.classpath
index 4ed362202..9b920b1bb 100644
--- a/app/.classpath
+++ b/app/.classpath
@@ -38,8 +38,8 @@
 	<classpathentry kind="lib" path="lib/jmdns-3.5.5.jar"/>
 	<classpathentry kind="lib" path="lib/slf4j-api-1.7.22.jar"/>
 	<classpathentry kind="lib" path="lib/slf4j-simple-1.7.22.jar"/>
-	<classpathentry kind="lib" path="lib/log4j-api-2.15.0.jar"/>
-	<classpathentry kind="lib" path="lib/log4j-core-2.15.0.jar"/>
+	<classpathentry kind="lib" path="lib/log4j-api-2.16.0.jar"/>
+	<classpathentry kind="lib" path="lib/log4j-core-2.16.0.jar"/>
 	<classpathentry kind="lib" path="lib/jsch-0.1.50.jar"/>
 	<classpathentry kind="lib" path="lib/rsyntaxtextarea-3.0.3-SNAPSHOT.jar"/>
 	<classpathentry kind="lib" path="lib/xml-apis-1.3.04.jar"/>
diff --git a/app/lib/log4j-api-2.15.0.jar b/app/lib/log4j-api-2.16.0.jar
index 77f6b2bef..2cdcc4b07 100644
--- a/app/lib/log4j-api-2.15.0.jar
+++ b/app/lib/log4j-api-2.16.0.jar
diff --git a/app/lib/log4j-core-2.15.0.jar b/app/lib/log4j-core-2.16.0.jar
index 5d6a73a65..bc913bc53 100644
--- a/app/lib/log4j-core-2.15.0.jar
+++ b/app/lib/log4j-core-2.16.0.jar
diff --git a/arduino-core/.classpath b/arduino-core/.classpath
index 1b3e5a9b1..42c399786 100644
--- a/arduino-core/.classpath
+++ b/arduino-core/.classpath
@@ -8,8 +8,8 @@
 	<classpathentry kind="lib" path="lib/jmdns-3.5.5.jar"/>
 	<classpathentry kind="lib" path="lib/slf4j-api-1.7.22.jar"/>
 	<classpathentry kind="lib" path="lib/slf4j-simple-1.7.22.jar"/>
-	<classpathentry kind="lib" path="lib/log4j-api-2.15.0.jar"/>
-	<classpathentry kind="lib" path="lib/log4j-core-2.15.0.jar"/>
+	<classpathentry kind="lib" path="lib/log4j-api-2.16.0.jar"/>
+	<classpathentry kind="lib" path="lib/log4j-core-2.16.0.jar"/>
 	<classpathentry kind="lib" path="lib/jsch-0.1.50.jar"/>
 	<classpathentry kind="lib" path="lib/commons-exec-1.1.jar"/>
 	<classpathentry kind="lib" path="../app/lib/commons-httpclient-3.1.jar"/>
diff --git a/arduino-core/lib/log4j-api-2.15.0.jar b/arduino-core/lib/log4j-api-2.16.0.jar
index 77f6b2bef..2cdcc4b07 100644
--- a/arduino-core/lib/log4j-api-2.15.0.jar
+++ b/arduino-core/lib/log4j-api-2.16.0.jar
diff --git a/arduino-core/lib/log4j-core-2.15.0.jar b/arduino-core/lib/log4j-core-2.16.0.jar
index 5d6a73a65..bc913bc53 100644
--- a/arduino-core/lib/log4j-core-2.15.0.jar
+++ b/arduino-core/lib/log4j-core-2.16.0.jar
diff --git a/arduino-core/src/processing/app/BaseNoGui.java b/arduino-core/src/processing/app/BaseNoGui.java
index f648d87da..e1fe0de98 100644
--- a/arduino-core/src/processing/app/BaseNoGui.java
+++ b/arduino-core/src/processing/app/BaseNoGui.java
@@ -41,9 +41,9 @@ import static processing.app.helpers.filefilters.OnlyDirs.ONLY_DIRS;
 public class BaseNoGui {
 
   /** Version string to be used for build */
-  public static final int REVISION = 10817;
+  public static final int REVISION = 10818;
   /** Extended version string displayed on GUI */
-  public static final String VERSION_NAME = "1.8.17";
+  public static final String VERSION_NAME = "1.8.18";
   public static final String VERSION_NAME_LONG;
 
   // Current directory to use for relative paths specified on the
diff --git a/build/shared/revisions.txt b/build/shared/revisions.txt
index 1ac685396..b41e1b44f 100644
--- a/build/shared/revisions.txt
+++ b/build/shared/revisions.txt
@@ -1,4 +1,10 @@
-ARDUINO 1.8.17 2021.12.14 SECURITY HOTFIX RELEASE
+ARDUINO 1.8.18 2021.12.14 SECURITY HOTFIX RELEASE
+
+[ide]
+* Upgrade log4j to 2.16.0 - Extra hardening for CVE-2021-44228
+
+
+ARDUINO 1.8.17 (not released superseded by 1.8.18)
 
 [ide]
 * Upgrade log4j to 2.15.0 - CVE-2021-44228 (thanks @rhowe)