Merge pull request #57 from CaritasDeutschland/fix-log4j

fix: force safe log4j version
Onlineberatung · Dec 15, 2021 · f359734 · f359734
2 parents c085d24 + f0d3b52
commit f359734
Showing 1 changed file with 13 additions and 0 deletions.
diff --git a/pom.xml b/pom.xml
@@ -24,6 +24,8 @@
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
     <java.version>11</java.version>
+    <!-- force at least version 2.16 due to https://logging.apache.org/log4j/2.x/security.html -->
+    <log4j.version>2.16.0</log4j.version>
   </properties>
 
   <dependencies>
@@ -142,6 +144,17 @@
       <artifactId>mariadb-java-client</artifactId>
     </dependency>
 
+    <dependency>
+      <groupId>org.apache.logging.log4j</groupId>
+      <artifactId>log4j-api</artifactId>
+      <version>${log4j.version}</version>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.logging.log4j</groupId>
+      <artifactId>log4j-to-slf4j</artifactId>
+      <version>${log4j.version}</version>
+    </dependency>
+
     <!-- Test scope dependencies -->
     <dependency>
       <groupId>com.h2database</groupId>