id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc
15845	jdk-17.0.1	Douglas R. Reno	Douglas R. Reno	"New major version.

Note that this is a supported LTS release until at least April 2022, with a major distribution like RedHat taking support after that.

We should update this to assist with preventing attacks with Log4j, like ones that have been described using Minecraft. I have personally confirmed this update to prevent remote code execution using the Minecraft 1.18 server and a client running 1.18.1.

Some news articles:

https://www.wired.com/story/log4j-flaw-hacking-internet/

https://www.zdnet.com/article/security-warning-new-zero-day-in-the-log4j-java-library-is-already-being-exploited/

https://arstechnica.com/information-technology/2021/12/minecraft-and-other-apps-face-serious-threat-from-new-code-execution-bug/

https://arstechnica.com/information-technology/2021/12/the-critical-log4shell-zero-day-affects-a-whos-who-of-big-cloud-services/

https://www.theverge.com/2021/12/10/22828303/log4j-library-vulnerability-log4shell-zero-day-exploit

https://www.bleepingcomputer.com/news/security/new-zero-day-exploit-for-log4j-java-library-is-an-enterprise-nightmare/

U.S. Government Advisory: https://www.cisa.gov/uscert/ncas/current-activity/2021/12/10/apache-releases-log4j-version-2150-address-critical-rce

Since 16.0.2 is unsupported anyway, and we'd have to create new binaries, I don't really feel like it's worth the trouble to patch it at this time. Updating to 17.0.2 is the best way.

Quote from Cloudflare: ""When I look back over the last 10 years, there are only two other exploits I can think of with a similar severity: Heartbleed, which allowed you to get information from servers that should have been secure, and Shellshock, which allowed you to run code on a remote machine."""	enhancement	closed	high	11.1	BOOK	git	critical	fixed