From 5f0f9e8d7aa55bc933b23d1c5cc3028fb3b4888e Mon Sep 17 00:00:00 2001 From: Chris Beams Date: Fri, 10 Dec 2021 10:40:36 +0100 Subject: [PATCH] Avoid Log4J "Log4Shell" exploit This commit upgrades our transitive dependency on Log4J 2 from 2.14.1 to the newly-released 2.15.0 to avoid the CVE described at https://www.lunasec.io/docs/blog/log4j-zero-day/. We do not use log4j directly anywhere in our codebase, so our exposure to this exploit was already mitigated if not eliminated, but Spring Boot depends on Log4J 2 internally. This commit upgrades Spring Boot's underlying dependency on Log4J to 2.15.0 in the manner recommended at https://github.com/spring-projects/spring-boot/issues/28958. --- build.gradle | 2 ++ gradle/verification-metadata.xml | 26 ++++++++++++++++++++++++++ 2 files changed, 28 insertions(+) diff --git a/build.gradle b/build.gradle index ef5ac65a88c..b3c31938cd7 100644 --- a/build.gradle +++ b/build.gradle @@ -583,6 +583,8 @@ configure(project(':pricenode')) { "Implementation-Title": project.name, "Implementation-Version": version) + ext['log4j2.version'] = '2.15.0' + dependencies { implementation project(":common") implementation project(":core") diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index 3a03f4980da..14358c550fc 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -1883,6 +1883,11 @@ + + + + + @@ -1899,11 +1904,24 @@ + + + + + + + + + + + + + @@ -1920,6 +1938,14 @@ + + + + + + + +