What's new in Apache JMeter 5.4.3?
Tags: testing, performance, webperf, tutorial
Published: 2021-12-24 17:50:56

<!-- wp:paragraph -->
<p>The Apache JMeter team has released its next minor version of JMeter 5.4.3 for the Log4j security vulnerability CVE-2021-45105. In my last few articles, I have posted about <a href="https://qainsights.com/log4j-vulnerability-important-note-to-performance-engineers/">Log4j Vulnerability – Important Note to Performance Engineers</a>, <a href="https://qainsights.com/whats-new-in-apache-jmeter-5-4-2/">What’s new in Apache JMeter 5.4.2?</a>, and <a href="https://qainsights.com/what-to-do-if-you-cannot-upgrade-to-jmeter-5-4-2-for-log4j-vulnerability/">What to do if you cannot upgrade to JMeter 5.4.2 for Log4j Vulnerability?</a>. Let us see what's new in Apache JMeter 5.4.3.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>About CVE-2021-45105</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>Apache JMeter 5.4.3</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>As this minor patch addresses CVE-2021-45105, it doesn't have any new and noteworthy section. There are no other bug fixes, enhancements, samplers, etc. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>JMeter 5.4.3 has bumped up versions of log4j from 2.16.0 to 2.17.0.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>To download the latest version of JMeter, head to https://jmeter.apache.org/download_jmeter.cgi</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Click any one of the apache-jmeter-5.4.3 flavor to download.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>After download the file, verify the integrity using the sha512 checksum. </p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","id":8978,"sizeSlug":"full","linkDestination":"media"} -->
<div class="wp-block-image"><figure class="aligncenter size-full"><a href="https://qainsights.com/wp-content/uploads/2021/12/image-36.png"><img src="https://qainsights.com/wp-content/uploads/2021/12/image-36.png" alt="What's new in Apache JMeter 5.4.3?" class="wp-image-8978"/></a><figcaption>What's new in Apache JMeter 5.4.3?</figcaption></figure></div>
<!-- /wp:image -->

<!-- wp:heading -->
<h2>JMeter Release process</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>There are multiple steps involved in releasing the newer version. Since this is a security fix, the votes are solicited for 24 hrs and closed.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","id":8979,"sizeSlug":"full","linkDestination":"media"} -->
<div class="wp-block-image"><figure class="aligncenter size-full"><a href="https://qainsights.com/wp-content/uploads/2021/12/image-37.png"><img src="https://qainsights.com/wp-content/uploads/2021/12/image-37.png" alt="JMeter 5.4.3 votes" class="wp-image-8979"/></a><figcaption>JMeter 5.4.3 votes</figcaption></figure></div>
<!-- /wp:image -->

<!-- wp:heading -->
<h2>Conclusion</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>It is recommended to update your JMeter to 5.4.3. Suppose, if you are not able to upgrade, there are workarounds mentioned in <a href="https://qainsights.com/what-to-do-if-you-cannot-upgrade-to-jmeter-5-4-2-for-log4j-vulnerability/" target="_blank" rel="noreferrer noopener">this article</a>.</p>
<!-- /wp:paragraph -->