kazusa
/
skywalking
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bump up log4j2 to 2.17 (#8314)

This commit is contained in:
kezhenxu94 2021-12-18 22:40:38 +08:00 committed by GitHub
parent af036a97f6
commit a02dd9c2d1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
CHANGES.md
View File

@ -7,7 +7,7 @@ Release Notes.
#### Project #### Project
* Upgrade log4j2 to 2.16.0 for CVE-2021-44228 and CVE-2021-45046. This CVE only effects on JDK if JDNI is opened in * Upgrade log4j2 to 2.17.0 for CVE-2021-44228, CVE-2021-45046 and CVE-2021-45105. This CVE only effects on JDK if JNDI is opened in
default. Notice, using JVM option `-Dlog4j2.formatMsgNoLookups=true` or setting default. Notice, using JVM option `-Dlog4j2.formatMsgNoLookups=true` or setting
the `LOG4J_FORMAT_MSG_NO_LOOKUPS=”true”` environment variable also avoids CVEs. the `LOG4J_FORMAT_MSG_NO_LOOKUPS=”true”` environment variable also avoids CVEs.

2
dist-material/release-docs/LICENSE
View File

@ -249,7 +249,7 @@ The text of each license is the standard Apache 2.0 license.
Apache: commons-lang 3.6: https://github.com/apache/commons-lang, Apache 2.0 Apache: commons-lang 3.6: https://github.com/apache/commons-lang, Apache 2.0
Apache: commons-text 1.8: https://github.com/apache/commons-text, Apache 2.0 Apache: commons-text 1.8: https://github.com/apache/commons-text, Apache 2.0
Apache: commons-beanutils 1.9.4: https://github.com/apache/commons-beanutils, Apache 2.0 Apache: commons-beanutils 1.9.4: https://github.com/apache/commons-beanutils, Apache 2.0
Apache: log4j2 2.15.0: https://github.com/apache/logging-log4j2, Apache 2.0 Apache: log4j2 2.17.0: https://github.com/apache/logging-log4j2, Apache 2.0
Apache: zookeeper 3.5.7: https://github.com/apache/zookeeper, Apache 2.0 Apache: zookeeper 3.5.7: https://github.com/apache/zookeeper, Apache 2.0
Apache: commons-collections 3.2.2: https://github.com/apache/commons-collections, Apache 2.0 Apache: commons-collections 3.2.2: https://github.com/apache/commons-collections, Apache 2.0
Apache: commons-configuration 1.8: https://github.com/apache/commons-configuration, Apache 2.0 Apache: commons-configuration 1.8: https://github.com/apache/commons-configuration, Apache 2.0

2
oap-server-bom/pom.xml
View File

@ -29,7 +29,7 @@
<properties> <properties>
<slf4j.version>1.7.30</slf4j.version> <slf4j.version>1.7.30</slf4j.version>
<log4j.version>2.16.0</log4j.version> <log4j.version>2.17.0</log4j.version>
<graphql-java-tools.version>5.2.3</graphql-java-tools.version> <graphql-java-tools.version>5.2.3</graphql-java-tools.version>
<graphql-java.version>8.0</graphql-java.version> <graphql-java.version>8.0</graphql-java.version>
<okhttp.version>3.14.9</okhttp.version> <okhttp.version>3.14.9</okhttp.version>

6
tools/dependencies/known-oap-backend-dependencies.txt
View File

@ -93,10 +93,10 @@ kotlin-reflect-1.1.1.jar
kotlin-stdlib-1.1.60.jar kotlin-stdlib-1.1.60.jar
libthrift-0.14.1.jar libthrift-0.14.1.jar
listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
log4j-api-2.16.0.jar log4j-api-2.17.0.jar
log4j-core-2.16.0.jar log4j-core-2.17.0.jar
log4j-over-slf4j-1.7.30.jar log4j-over-slf4j-1.7.30.jar
log4j-slf4j-impl-2.16.0.jar log4j-slf4j-impl-2.17.0.jar
logging-interceptor-3.13.1.jar logging-interceptor-3.13.1.jar
lz4-java-1.6.0.jar lz4-java-1.6.0.jar
micrometer-core-1.7.6.jar micrometer-core-1.7.6.jar