Java Buildpack v4.47

I'm pleased to announce the release of the java-buildpack, version 4.47. This release focuses on dependency updates, primarily that fix the latest Apache Log4j2 vulnerability, CVE-2021-45105, in dependencies used by the Java buildpack.

In particular, the following dependencies have been updated to include Log4j 2.17.0 and have been patched in this release:

• AppDynamics Java Agent (21.11.3)
• New Relic Java Agent (7.4.3)

If you are using an online version of the Java buildpack you do not strictly need this update, as the online buildpack will always pick the latest version of dependencies.

For a more detailed look at the changes in 4.47, please take a look at the commit log. The packaged version of the buildpack, suitable for use with create-buildpack and update-buildpack, can be found attached to this release.

Packaged Dependencies

Dependency	Version	CVEs	Release Notes
AppDynamics Agent	21.11.3_33314		Release Notes
Azure Application Insights Agent	2.6.2		Release Notes
CA Introscope APM Framework	21.11.0_20
Client Certificate Mapper	1.11.0_RELEASE	Included inline above	Included inline above
Container Security Provider	1.19.0_RELEASE	Included inline above	Included inline above
Contrast Security Agent	3.9.0_23825		Release Notes
Datadog APM Javaagent	0.92.0		Release Notes
Elastic APM Agent	1.28.2		Release Notes
Gemalto Luna Security Provider	7.4.0		Release Notes
Gemalto ProtectApp Security Provider	8.4.0
Geode Tomcat Session Store	1.12.4
Google Stackdriver Debugger	2.29.0		Release Notes
Google Stackdriver Profiler	0.1.0		Release Notes
Groovy	2.5.15		Release Notes
JaCoCo Agent	0.8.7		Release Notes
Java Memory Assistant Agent	0.5.0
Java Memory Assistant Clean Up	0.1.0
JProfiler Profiler	12.0.4		ChangeLog
JRebel Agent	2021.4.2		ChangeLog
jvmkill Agent	1.16.0_RELEASE	Included inline above	Included inline above
MariaDB JDBC Driver	2.7.2		Release Notes
Memory Calculator	3.13.0_RELEASE	Included inline above	Included inline above
Metric Writer	3.5.0_RELEASE	Included inline above	Included inline above
New Relic Agent	7.4.3		Release Notes
OpenJDK JRE	1.8.0_312	Risk Matrix	Release Notes
OpenJDK JRE 11	11.0.13_8	Risk Matrix	Release Notes
OpenJDK JRE 17	17.0.1_12	Risk Matrix	Release Notes
PostgreSQL JDBC Driver	42.3.1		ChangeLog
Redis Session Store	1.3.6_RELEASE	Included inline above	Included inline above
Riverbed Appinternals Agent	11.8.5_BL527
SeaLights Agent	3.1.2056
SkyWalking	6.6.0		ChangeLog
Spring Auto-reconfiguration	2.12.0_RELEASE	Included inline above	Included inline above
Spring Boot CLI	2.6.1
Spring Boot Container Customizer	2.6.0_RELEASE	Included inline above	Included inline above
Takipi Agent	4.64.2		Release Notes
Tomcat	9.0.56	Security	ChangeLog
Tomcat Access Logging Support	3.3.0_RELEASE	Included inline above	Included inline above
Tomcat Lifecycle Support	3.3.0_RELEASE	Included inline above	Included inline above
Tomcat Logging Support	3.3.0_RELEASE	Included inline above	Included inline above
YourKit Profiler	2021.11.221		Release Notes

Dependency Notes

• Elastic APM have announced that their Java agent is not vulnerable to CVE-2021-45105
• The Geode Tomcat Session Store dependency is also not vulnerable due to the specific configuration required.
• Thales (formerly Gemalto) ProtectApp has not released an update with patches for either CVE-2021-44228, CVE-2021-45046 & CVE-2021-45105. We have contacted the vendor to request one and are awaiting a fix. Because this needs to come from a 3rd party vendor we cannot provide a timeline for when this will happen. If you are using ProtectApp and have a support contract with the vendor, we suggest you file a ticket and also request a patch.