Arduino 1.8.17

[PaulStoffregen]

Looks like Arduino will release 1.8.17 by the end of this week.

https://support.arduino.cc/hc/en-us...sponse-to-Log4j2-vulnerability-CVE-2021-44228

Whether they include any changes other than updating the log4j library isn't known. So far nothing appears to be merged on github and they've had almost no activity on the 1.8.x IDE lately.

 

[PaulStoffregen]

Looks like they might skip 17 and call it 1.8.18.

 

[mjs513]

Only thing I see in revions.txt associated with the Starting 1.8.18

ARDUINO 1.8.18 2021.12.14 SECURITY HOTFIX RELEASE


ARDUINO 1.8.17 (not released superseded by 1.8.18)

[ide]
* Upgrade log4j to 2.15.0 - CVE-2021-44228 (thanks @rhowe)

So doen't look like much

 

[PaulStoffregen]

Yup, looks like the next release will be exactly the same as 1.8.16 but with the log4j library updated.

 

[PaulStoffregen]

Looks like they had 1.8.17 all packaged up and ready to go for release today. Downloadable 1.8.17 files are on their server, just not linked from anywhere, but easy to download if you copy the 1.8.16 link and edit it to 1.8.17.

 

[jonr]

I don't know if the log4j bug can be exploited via arduino, but I think the safe thing is to assume that it can. So to avoid malicious code running on your computer, it might be wise to upgrade to 1.8.18 arduino and this teensyduino:

https://forum.pjrc.com/threads/68972-Teensyduino-1-56-Beta-4

 

[PaulStoffregen]

Maybe this means we'll get Arduino 1.8.19 next week?

https://logging.apache.org/log4j/2.x/security.html

1.8.18 updated log4j to version 2.16.

 

[jonr]

On top of that DOS attack, there is this - which evidently makes the original flaw worse then expected.

https://www.zdnet.com/article/security-firm-blumira-discovers-major-new-log4j-attack-vector/

 

[PaulStoffregen]

Looks like Arduino is going to permanently remove log4j.

https://github.com/arduino/Arduino/pull/11730

Whether this means 1.8.19 in the coming days, not sure?

 

[PaulStoffregen]

Yup, looks like 1.8.19 will be inbound soon.

https://github.com/arduino/Arduino/commit/5e38fe2937439a1d1f7b1c70c48446501cc50621