From 06ff7005a3f70f0137ba1aae6bb22b31e36f7346 Mon Sep 17 00:00:00 2001 From: Levy Ehrstein Date: Sat, 11 Dec 2021 10:06:41 +0100 Subject: [PATCH] fix: log4j patch being applied to <1.7 versions As described in https://www.minecraft.net/en-us/article/important-message--security-vulnerability-java-edition, versions below 1.7 are not affected by the log4j exploit. They should therefore not use any mitigations. See #1179 discussion after merge. Reported-and-tested-by: Daniel Porter "Stealthii" --- scripts/start-finalExec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/scripts/start-finalExec b/scripts/start-finalExec index 78603ebcb76..1f7fcdd2bb9 100755 --- a/scripts/start-finalExec +++ b/scripts/start-finalExec @@ -96,7 +96,10 @@ patchLog4jConfig() { } # Patch Log4j remote code execution vulnerability -if isFamily VANILLA && versionLessThan 1.12; then +# See https://www.minecraft.net/en-us/article/important-message--security-vulnerability-java-edition +if versionLessThan 1.7; then + : # No patch required here. +elif isFamily VANILLA && versionLessThan 1.12; then patchLog4jConfig log4j2_17-111.xml https://launcher.mojang.com/v1/objects/dd2b723346a8dcd48e7f4d245f6bf09e98db9696/log4j2_17-111.xml elif isFamily VANILLA && versionLessThan 1.17; then patchLog4jConfig log4j2_112-116.xml https://launcher.mojang.com/v1/objects/02937d122c86ce73319ef9975b58896fc1b491d1/log4j2_112-116.xml