From: Dan Timoney <dtimoney@att.com>
Date: Mon, 3 Jan 2022 16:49:40 +0000 (-0500)
Subject: Upgrade to log4j2 2.17.1
X-Git-Tag: 2.3.2~2
X-Git-Url: https://gerrit.onap.org/r/gitweb?a=commitdiff_plain;h=156d2a9035bee86af55d323ec387d64e125ee178;p=ccsdk%2Fparent.git

Upgrade to log4j2 2.17.1

Upgrade to log4j2 version 2.17.1 to correct log4shell vulnerability

Issue-ID: CCSDK-3556
Signed-off-by: Dan Timoney <dtimoney@att.com>
Change-Id: I61a3fdd9854a1beee70abed1fd8542cdf664756a
---

diff --git a/dependencies-bom/pom.xml b/dependencies-bom/pom.xml
index c1b3a798..a75fe208 100644
--- a/dependencies-bom/pom.xml
+++ b/dependencies-bom/pom.xml
@@ -211,12 +211,12 @@
             <dependency>
                 <groupId>org.apache.logging.log4j</groupId>
                 <artifactId>log4j-slf4j-impl</artifactId>
-                <version>2.16.0</version>
+                <version>2.17.1</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.logging.log4j</groupId>
                 <artifactId>log4j-core</artifactId>
-                <version>2.16.0</version>
+                <version>2.17.1</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.tomcat</groupId>
diff --git a/installed-odl-bom/pom.xml b/installed-odl-bom/pom.xml
index f7c9cc9e..776796f4 100644
--- a/installed-odl-bom/pom.xml
+++ b/installed-odl-bom/pom.xml
@@ -4179,17 +4179,17 @@
             <dependency>
                 <groupId>org.ops4j.pax.logging</groupId>
                 <artifactId>pax-logging-api</artifactId>
-                <version>2.0.9</version>
+                <version>2.0.14</version>
             </dependency>
             <dependency>
                 <groupId>org.ops4j.pax.logging</groupId>
                 <artifactId>pax-logging-log4j2</artifactId>
-                <version>2.0.9</version>
+                <version>2.0.14</version>
             </dependency>
             <dependency>
                 <groupId>org.ops4j.pax.logging</groupId>
                 <artifactId>pax-logging-logback</artifactId>
-                <version>2.0.9</version>
+                <version>2.0.14</version>
             </dependency>
             <dependency>
                 <groupId>org.ops4j.pax.tipi</groupId>
diff --git a/odlparent/binding-parent/pom.xml b/odlparent/binding-parent/pom.xml
index 97060313..667079af 100644
--- a/odlparent/binding-parent/pom.xml
+++ b/odlparent/binding-parent/pom.xml
@@ -177,8 +177,8 @@
         <eelf.version>1.0.0</eelf.version>
         <grpc.version>1.21.1</grpc.version>
         <jetty.version>9.4.40.v20210413</jetty.version>
-        <log4j.version>2.16.0</log4j.version>
-        <log4j2.version>2.16.0</log4j2.version>
+        <log4j.version>2.17.1</log4j.version>
+        <log4j2.version>2.17.1</log4j2.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <mariadb4j.version>2.4.0</mariadb4j.version>
         <testng.version>6.14.3</testng.version>
diff --git a/odlparent/bundle-parent/pom.xml b/odlparent/bundle-parent/pom.xml
index 5f3366d3..06cc518b 100644
--- a/odlparent/bundle-parent/pom.xml
+++ b/odlparent/bundle-parent/pom.xml
@@ -177,8 +177,8 @@
         <eelf.version>1.0.0</eelf.version>
         <grpc.version>1.21.1</grpc.version>
         <jetty.version>9.4.40.v20210413</jetty.version>
-        <log4j.version>2.16.0</log4j.version>
-        <log4j2.version>2.16.0</log4j2.version>
+        <log4j.version>2.17.1</log4j.version>
+        <log4j2.version>2.17.1</log4j2.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <mariadb4j.version>2.4.0</mariadb4j.version>
         <testng.version>6.14.3</testng.version>
diff --git a/odlparent/feature-repo-parent/pom.xml b/odlparent/feature-repo-parent/pom.xml
index 14fd1d98..3d7d0ca7 100644
--- a/odlparent/feature-repo-parent/pom.xml
+++ b/odlparent/feature-repo-parent/pom.xml
@@ -177,8 +177,8 @@
         <eelf.version>1.0.0</eelf.version>
         <grpc.version>1.21.1</grpc.version>
         <jetty.version>9.4.40.v20210413</jetty.version>
-        <log4j.version>2.16.0</log4j.version>
-        <log4j2.version>2.16.0</log4j2.version>
+        <log4j.version>2.17.1</log4j.version>
+        <log4j2.version>2.17.1</log4j2.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <mariadb4j.version>2.4.0</mariadb4j.version>
         <testng.version>6.14.3</testng.version>
diff --git a/odlparent/karaf4-parent/pom.xml b/odlparent/karaf4-parent/pom.xml
index 69cea201..949eb710 100644
--- a/odlparent/karaf4-parent/pom.xml
+++ b/odlparent/karaf4-parent/pom.xml
@@ -177,8 +177,8 @@
         <eelf.version>1.0.0</eelf.version>
         <grpc.version>1.21.1</grpc.version>
         <jetty.version>9.4.40.v20210413</jetty.version>
-        <log4j.version>2.16.0</log4j.version>
-        <log4j2.version>2.16.0</log4j2.version>
+        <log4j.version>2.17.1</log4j.version>
+        <log4j2.version>2.17.1</log4j2.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <mariadb4j.version>2.4.0</mariadb4j.version>
         <testng.version>6.14.3</testng.version>
diff --git a/odlparent/mdsal-it-parent/pom.xml b/odlparent/mdsal-it-parent/pom.xml
index bced9bc1..c07e75a3 100644
--- a/odlparent/mdsal-it-parent/pom.xml
+++ b/odlparent/mdsal-it-parent/pom.xml
@@ -177,8 +177,8 @@
         <eelf.version>1.0.0</eelf.version>
         <grpc.version>1.21.1</grpc.version>
         <jetty.version>9.4.40.v20210413</jetty.version>
-        <log4j.version>2.16.0</log4j.version>
-        <log4j2.version>2.16.0</log4j2.version>
+        <log4j.version>2.17.1</log4j.version>
+        <log4j2.version>2.17.1</log4j2.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <mariadb4j.version>2.4.0</mariadb4j.version>
         <testng.version>6.14.3</testng.version>
diff --git a/odlparent/odlparent-lite/pom.xml b/odlparent/odlparent-lite/pom.xml
index 72db8bb2..f0f3aa21 100644
--- a/odlparent/odlparent-lite/pom.xml
+++ b/odlparent/odlparent-lite/pom.xml
@@ -177,8 +177,8 @@
         <eelf.version>1.0.0</eelf.version>
         <grpc.version>1.21.1</grpc.version>
         <jetty.version>9.4.40.v20210413</jetty.version>
-        <log4j.version>2.16.0</log4j.version>
-        <log4j2.version>2.16.0</log4j2.version>
+        <log4j.version>2.17.1</log4j.version>
+        <log4j2.version>2.17.1</log4j2.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <mariadb4j.version>2.4.0</mariadb4j.version>
         <testng.version>6.14.3</testng.version>
diff --git a/odlparent/odlparent/pom.xml b/odlparent/odlparent/pom.xml
index 2c0b548d..40e4bcb8 100644
--- a/odlparent/odlparent/pom.xml
+++ b/odlparent/odlparent/pom.xml
@@ -177,8 +177,8 @@
         <eelf.version>1.0.0</eelf.version>
         <grpc.version>1.21.1</grpc.version>
         <jetty.version>9.4.40.v20210413</jetty.version>
-        <log4j.version>2.16.0</log4j.version>
-        <log4j2.version>2.16.0</log4j2.version>
+        <log4j.version>2.17.1</log4j.version>
+        <log4j2.version>2.17.1</log4j2.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <mariadb4j.version>2.4.0</mariadb4j.version>
         <testng.version>6.14.3</testng.version>
diff --git a/odlparent/setup/src/main/resources/pom-template.xml b/odlparent/setup/src/main/resources/pom-template.xml
index 3e3338fb..7a348e8c 100755
--- a/odlparent/setup/src/main/resources/pom-template.xml
+++ b/odlparent/setup/src/main/resources/pom-template.xml
@@ -177,8 +177,8 @@
         <eelf.version>1.0.0</eelf.version>
         <grpc.version>1.21.1</grpc.version>
         <jetty.version>9.4.40.v20210413</jetty.version>
-        <log4j.version>2.16.0</log4j.version>
-        <log4j2.version>2.16.0</log4j2.version>
+        <log4j.version>2.17.1</log4j.version>
+        <log4j2.version>2.17.1</log4j2.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <mariadb4j.version>2.4.0</mariadb4j.version>
         <testng.version>6.14.3</testng.version>
diff --git a/odlparent/single-feature-parent/pom.xml b/odlparent/single-feature-parent/pom.xml
index 7129e0ea..965dcef1 100644
--- a/odlparent/single-feature-parent/pom.xml
+++ b/odlparent/single-feature-parent/pom.xml
@@ -177,8 +177,8 @@
         <eelf.version>1.0.0</eelf.version>
         <grpc.version>1.21.1</grpc.version>
         <jetty.version>9.4.40.v20210413</jetty.version>
-        <log4j.version>2.16.0</log4j.version>
-        <log4j2.version>2.16.0</log4j2.version>
+        <log4j.version>2.17.1</log4j.version>
+        <log4j2.version>2.17.1</log4j2.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <mariadb4j.version>2.4.0</mariadb4j.version>
         <testng.version>6.14.3</testng.version>
diff --git a/oparent/pom.xml b/oparent/pom.xml
index c72af7f4..7c29bebb 100755
--- a/oparent/pom.xml
+++ b/oparent/pom.xml
@@ -77,8 +77,8 @@
         <ccsdk.sli.plugins.version>${ccsdk.sli.version}</ccsdk.sli.plugins.version>
         <ccsdk.distribution.version>1.1.1-SNAPSHOT</ccsdk.distribution.version>
 
-        <log4j.version>2.16.0</log4j.version>
-        <log4j2.version>2.16.0</log4j2.version>
+        <log4j.version>2.17.1</log4j.version>
+        <log4j2.version>2.17.1</log4j2.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <fasterxml.jackson.version>2.10.5</fasterxml.jackson.version>
         <velocity.version>2.3</velocity.version>
diff --git a/springboot/spring-boot-setup/src/main/resources/pom-template.xml b/springboot/spring-boot-setup/src/main/resources/pom-template.xml
index 9d176c63..efa15a33 100644
--- a/springboot/spring-boot-setup/src/main/resources/pom-template.xml
+++ b/springboot/spring-boot-setup/src/main/resources/pom-template.xml
@@ -130,8 +130,8 @@
         <jersey.version>${springboot.jersey.version}</jersey.version>
         <jersey.client.version>${springboot.jersey.version}</jersey.client.version>
         <jettison.version>1.3.8</jettison.version>
-        <log4j.version>2.16.0</log4j.version>
-        <log4j2.version>2.16.0</log4j2.version>
+        <log4j.version>2.17.1</log4j.version>
+        <log4j2.version>2.17.1</log4j2.version>
         <logback.version>1.2.3</logback.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <mariadb4j.version>2.4.0</mariadb4j.version>
diff --git a/springboot/springboot1/pom.xml b/springboot/springboot1/pom.xml
index 22f35514..e04483ff 100644
--- a/springboot/springboot1/pom.xml
+++ b/springboot/springboot1/pom.xml
@@ -130,8 +130,8 @@
         <jersey.version>2.30.1</jersey.version>
         <jersey.client.version>2.30.1</jersey.client.version>
         <jettison.version>1.3.8</jettison.version>
-        <log4j.version>2.16.0</log4j.version>
-        <log4j2.version>2.16.0</log4j2.version>
+        <log4j.version>2.17.1</log4j.version>
+        <log4j2.version>2.17.1</log4j2.version>
         <logback.version>1.2.3</logback.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <mariadb4j.version>2.4.0</mariadb4j.version>
diff --git a/springboot/springboot2/pom.xml b/springboot/springboot2/pom.xml
index f0b49740..644055ec 100644
--- a/springboot/springboot2/pom.xml
+++ b/springboot/springboot2/pom.xml
@@ -130,8 +130,8 @@
         <jersey.version>2.30.1</jersey.version>
         <jersey.client.version>2.30.1</jersey.client.version>
         <jettison.version>1.3.8</jettison.version>
-        <log4j.version>2.16.0</log4j.version>
-        <log4j2.version>2.16.0</log4j2.version>
+        <log4j.version>2.17.1</log4j.version>
+        <log4j2.version>2.17.1</log4j2.version>
         <logback.version>1.2.3</logback.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <mariadb4j.version>2.4.0</mariadb4j.version>
diff --git a/springboot/springboot25/pom.xml b/springboot/springboot25/pom.xml
index 5b45515c..85ed87bf 100644
--- a/springboot/springboot25/pom.xml
+++ b/springboot/springboot25/pom.xml
@@ -127,8 +127,8 @@
         <jersey.version>2.33</jersey.version>
         <jersey.client.version>2.33</jersey.client.version>
         <jettison.version>1.3.8</jettison.version>
-        <log4j.version>2.16.0</log4j.version>
-        <log4j2.version>2.16.0</log4j2.version>
+        <log4j.version>2.17.1</log4j.version>
+        <log4j2.version>2.17.1</log4j2.version>
         <logback.version>1.2.3</logback.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <mariadb4j.version>2.4.0</mariadb4j.version>
diff --git a/standalone/pom.xml b/standalone/pom.xml
index 12f0df42..6ac69113 100755
--- a/standalone/pom.xml
+++ b/standalone/pom.xml
@@ -65,8 +65,8 @@
         <bundle.plugin.version>2.5.0</bundle.plugin.version>
         <checkstyle.skip>true</checkstyle.skip>
 
-        <log4j.version>2.16.0</log4j.version>
-        <log4j2.version>2.16.0</log4j2.version>
+        <log4j.version>2.17.1</log4j.version>
+        <log4j2.version>2.17.1</log4j2.version>
         <mariadb.connector.version>2.7.2</mariadb.connector.version>
         <fasterxml.jackson.version>2.12.4</fasterxml.jackson.version>
         <velocity.version>2.3</velocity.version>
@@ -101,10 +101,20 @@
                 <artifactId>slf4j-api</artifactId>
                 <version>1.7.29</version>
             </dependency>
+            <dependency>
+                <groupId>org.apache.logging.log4j</groupId>
+                <artifactId>log4j-api</artifactId>
+                <version>2.17.1</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.logging.log4j</groupId>
+                <artifactId>log4j-core</artifactId>
+                <version>2.17.1</version>
+            </dependency>
             <dependency>
                 <groupId>org.apache.logging.log4j</groupId>
                 <artifactId>log4j-slf4j-impl</artifactId>
-                <version>2.15.0</version>
+                <version>2.17.1</version>
             </dependency>
             <dependency>
                 <groupId>com.fasterxml.jackson.core</groupId>