Merge pull request #30 from CaritasDeutschland/fix-log4j

fix: force safe log4j version
virtualidentityag · Dec 15, 2021 · ac1f419 · ac1f419
2 parents cfcf3ea + 0cb8d69
commit ac1f419
Showing 1 changed file with 13 additions and 0 deletions.
diff --git a/pom.xml b/pom.xml
@@ -22,6 +22,8 @@
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 		<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
 		<java.version>11</java.version>
+		<!-- force at least version 2.16 due to https://logging.apache.org/log4j/2.x/security.html -->
+		<log4j.version>2.16.0</log4j.version>
 	</properties>
 
 	<dependencies>
@@ -156,6 +158,17 @@
 			<scope>test</scope>
 		</dependency>
 
+		<dependency>
+			<groupId>org.apache.logging.log4j</groupId>
+			<artifactId>log4j-api</artifactId>
+			<version>${log4j.version}</version>
+		</dependency>
+		<dependency>
+			<groupId>org.apache.logging.log4j</groupId>
+			<artifactId>log4j-to-slf4j</artifactId>
+			<version>${log4j.version}</version>
+		</dependency>
+
 	</dependencies>
 
 	<dependencyManagement>