From 2f6c03b602c8eb4f31ba6e487365a79004fae79b Mon Sep 17 00:00:00 2001
From: Dan Timoney <dtimoney@att.com>
Date: Mon, 13 Dec 2021 15:59:55 -0500
Subject: [PATCH] Upgrade log4j to version 2.15.0

Update log4j version to address known vulnerability

Issue-ID: CCSDK-3556
Signed-off-by: Dan Timoney <dtimoney@att.com>
Change-Id: Ie0840a7f45257092c93bd5dbb23d197a1de491b0
---
 dependencies-bom/pom.xml                                         | 4 ++--
 odlparent/binding-parent/pom.xml                                 | 5 ++++-
 odlparent/bundle-parent/pom.xml                                  | 5 ++++-
 odlparent/feature-repo-parent/pom.xml                            | 5 ++++-
 odlparent/karaf4-parent/pom.xml                                  | 5 ++++-
 odlparent/mdsal-it-parent/pom.xml                                | 5 ++++-
 odlparent/odlparent-lite/pom.xml                                 | 5 ++++-
 odlparent/odlparent/pom.xml                                      | 5 ++++-
 odlparent/setup/src/main/resources/pom-template.xml              | 5 ++++-
 odlparent/single-feature-parent/pom.xml                          | 5 ++++-
 oparent/pom.xml                                                  | 2 ++
 springboot/spring-boot-setup/src/main/resources/pom-template.xml | 2 ++
 springboot/springboot1/pom.xml                                   | 2 ++
 springboot/springboot2/pom.xml                                   | 2 ++
 standalone/pom.xml                                               | 4 +++-
 15 files changed, 49 insertions(+), 12 deletions(-)

diff --git a/dependencies-bom/pom.xml b/dependencies-bom/pom.xml
index 728c60fd..ca1b475d 100644
--- a/dependencies-bom/pom.xml
+++ b/dependencies-bom/pom.xml
@@ -211,12 +211,12 @@
             <dependency>
                 <groupId>org.apache.logging.log4j</groupId>
                 <artifactId>log4j-slf4j-impl</artifactId>
-                <version>2.11.2</version>
+                <version>2.15.0</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.logging.log4j</groupId>
                 <artifactId>log4j-core</artifactId>
-                <version>2.14.1</version>
+                <version>2.15.0</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.tomcat</groupId>
diff --git a/odlparent/binding-parent/pom.xml b/odlparent/binding-parent/pom.xml
index 30a4638d..f9e9812b 100644
--- a/odlparent/binding-parent/pom.xml
+++ b/odlparent/binding-parent/pom.xml
@@ -176,11 +176,14 @@
         <derby.version>10.14.2.0</derby.version>
         <eelf.version>1.0.0</eelf.version>
         <grpc.version>1.21.1</grpc.version>
+        <jetty.version>9.4.40.v20210413</jetty.version>
+        <log4j.version>2.15.0</log4j.version>
+        <log4j2.version>2.15.0</log4j2.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <mariadb4j.version>2.4.0</mariadb4j.version>
         <testng.version>6.14.3</testng.version>
         <tomcat-jdbc.version>9.0.52</tomcat-jdbc.version>
-        <jetty.version>9.4.40.v20210413</jetty.version>
+        
         <skip.karaf.featureTest>true</skip.karaf.featureTest>
         <dependency-list.file>direct-dependencies.txt</dependency-list.file>
     </properties>
diff --git a/odlparent/bundle-parent/pom.xml b/odlparent/bundle-parent/pom.xml
index a55e5f21..80eef04d 100644
--- a/odlparent/bundle-parent/pom.xml
+++ b/odlparent/bundle-parent/pom.xml
@@ -176,11 +176,14 @@
         <derby.version>10.14.2.0</derby.version>
         <eelf.version>1.0.0</eelf.version>
         <grpc.version>1.21.1</grpc.version>
+        <jetty.version>9.4.40.v20210413</jetty.version>
+        <log4j.version>2.15.0</log4j.version>
+        <log4j2.version>2.15.0</log4j2.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <mariadb4j.version>2.4.0</mariadb4j.version>
         <testng.version>6.14.3</testng.version>
         <tomcat-jdbc.version>9.0.52</tomcat-jdbc.version>
-        <jetty.version>9.4.40.v20210413</jetty.version>
+        
         <skip.karaf.featureTest>true</skip.karaf.featureTest>
         <dependency-list.file>direct-dependencies.txt</dependency-list.file>
     </properties>
diff --git a/odlparent/feature-repo-parent/pom.xml b/odlparent/feature-repo-parent/pom.xml
index 21acb348..6adf57cd 100644
--- a/odlparent/feature-repo-parent/pom.xml
+++ b/odlparent/feature-repo-parent/pom.xml
@@ -176,11 +176,14 @@
         <derby.version>10.14.2.0</derby.version>
         <eelf.version>1.0.0</eelf.version>
         <grpc.version>1.21.1</grpc.version>
+        <jetty.version>9.4.40.v20210413</jetty.version>
+        <log4j.version>2.15.0</log4j.version>
+        <log4j2.version>2.15.0</log4j2.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <mariadb4j.version>2.4.0</mariadb4j.version>
         <testng.version>6.14.3</testng.version>
         <tomcat-jdbc.version>9.0.52</tomcat-jdbc.version>
-        <jetty.version>9.4.40.v20210413</jetty.version>
+        
         <skip.karaf.featureTest>true</skip.karaf.featureTest>
         <dependency-list.file>direct-dependencies.txt</dependency-list.file>
     </properties>
diff --git a/odlparent/karaf4-parent/pom.xml b/odlparent/karaf4-parent/pom.xml
index 0540b644..909d3439 100644
--- a/odlparent/karaf4-parent/pom.xml
+++ b/odlparent/karaf4-parent/pom.xml
@@ -176,11 +176,14 @@
         <derby.version>10.14.2.0</derby.version>
         <eelf.version>1.0.0</eelf.version>
         <grpc.version>1.21.1</grpc.version>
+        <jetty.version>9.4.40.v20210413</jetty.version>
+        <log4j.version>2.15.0</log4j.version>
+        <log4j2.version>2.15.0</log4j2.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <mariadb4j.version>2.4.0</mariadb4j.version>
         <testng.version>6.14.3</testng.version>
         <tomcat-jdbc.version>9.0.52</tomcat-jdbc.version>
-        <jetty.version>9.4.40.v20210413</jetty.version>
+        
         <skip.karaf.featureTest>true</skip.karaf.featureTest>
         <dependency-list.file>direct-dependencies.txt</dependency-list.file>
     </properties>
diff --git a/odlparent/mdsal-it-parent/pom.xml b/odlparent/mdsal-it-parent/pom.xml
index 1c16deec..ff3dbd81 100644
--- a/odlparent/mdsal-it-parent/pom.xml
+++ b/odlparent/mdsal-it-parent/pom.xml
@@ -176,11 +176,14 @@
         <derby.version>10.14.2.0</derby.version>
         <eelf.version>1.0.0</eelf.version>
         <grpc.version>1.21.1</grpc.version>
+        <jetty.version>9.4.40.v20210413</jetty.version>
+        <log4j.version>2.15.0</log4j.version>
+        <log4j2.version>2.15.0</log4j2.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <mariadb4j.version>2.4.0</mariadb4j.version>
         <testng.version>6.14.3</testng.version>
         <tomcat-jdbc.version>9.0.52</tomcat-jdbc.version>
-        <jetty.version>9.4.40.v20210413</jetty.version>
+        
         <skip.karaf.featureTest>true</skip.karaf.featureTest>
         <dependency-list.file>direct-dependencies.txt</dependency-list.file>
     </properties>
diff --git a/odlparent/odlparent-lite/pom.xml b/odlparent/odlparent-lite/pom.xml
index b8d7a7c8..2e06a05e 100644
--- a/odlparent/odlparent-lite/pom.xml
+++ b/odlparent/odlparent-lite/pom.xml
@@ -176,11 +176,14 @@
         <derby.version>10.14.2.0</derby.version>
         <eelf.version>1.0.0</eelf.version>
         <grpc.version>1.21.1</grpc.version>
+        <jetty.version>9.4.40.v20210413</jetty.version>
+        <log4j.version>2.15.0</log4j.version>
+        <log4j2.version>2.15.0</log4j2.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <mariadb4j.version>2.4.0</mariadb4j.version>
         <testng.version>6.14.3</testng.version>
         <tomcat-jdbc.version>9.0.52</tomcat-jdbc.version>
-        <jetty.version>9.4.40.v20210413</jetty.version>
+        
         <skip.karaf.featureTest>true</skip.karaf.featureTest>
         <dependency-list.file>direct-dependencies.txt</dependency-list.file>
     </properties>
diff --git a/odlparent/odlparent/pom.xml b/odlparent/odlparent/pom.xml
index f943dfc4..b6a21df3 100644
--- a/odlparent/odlparent/pom.xml
+++ b/odlparent/odlparent/pom.xml
@@ -176,11 +176,14 @@
         <derby.version>10.14.2.0</derby.version>
         <eelf.version>1.0.0</eelf.version>
         <grpc.version>1.21.1</grpc.version>
+        <jetty.version>9.4.40.v20210413</jetty.version>
+        <log4j.version>2.15.0</log4j.version>
+        <log4j2.version>2.15.0</log4j2.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <mariadb4j.version>2.4.0</mariadb4j.version>
         <testng.version>6.14.3</testng.version>
         <tomcat-jdbc.version>9.0.52</tomcat-jdbc.version>
-        <jetty.version>9.4.40.v20210413</jetty.version>
+        
         <skip.karaf.featureTest>true</skip.karaf.featureTest>
         <dependency-list.file>direct-dependencies.txt</dependency-list.file>
     </properties>
diff --git a/odlparent/setup/src/main/resources/pom-template.xml b/odlparent/setup/src/main/resources/pom-template.xml
index cd5b2594..acd39427 100755
--- a/odlparent/setup/src/main/resources/pom-template.xml
+++ b/odlparent/setup/src/main/resources/pom-template.xml
@@ -176,11 +176,14 @@
         <derby.version>10.14.2.0</derby.version>
         <eelf.version>1.0.0</eelf.version>
         <grpc.version>1.21.1</grpc.version>
+        <jetty.version>9.4.40.v20210413</jetty.version>
+        <log4j.version>2.15.0</log4j.version>
+        <log4j2.version>2.15.0</log4j2.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <mariadb4j.version>2.4.0</mariadb4j.version>
         <testng.version>6.14.3</testng.version>
         <tomcat-jdbc.version>9.0.52</tomcat-jdbc.version>
-        <jetty.version>9.4.40.v20210413</jetty.version>
+        
         <skip.karaf.featureTest>true</skip.karaf.featureTest>
         <dependency-list.file>direct-dependencies.txt</dependency-list.file>
     </properties>
diff --git a/odlparent/single-feature-parent/pom.xml b/odlparent/single-feature-parent/pom.xml
index 810ca4f0..25d54796 100644
--- a/odlparent/single-feature-parent/pom.xml
+++ b/odlparent/single-feature-parent/pom.xml
@@ -176,11 +176,14 @@
         <derby.version>10.14.2.0</derby.version>
         <eelf.version>1.0.0</eelf.version>
         <grpc.version>1.21.1</grpc.version>
+        <jetty.version>9.4.40.v20210413</jetty.version>
+        <log4j.version>2.15.0</log4j.version>
+        <log4j2.version>2.15.0</log4j2.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <mariadb4j.version>2.4.0</mariadb4j.version>
         <testng.version>6.14.3</testng.version>
         <tomcat-jdbc.version>9.0.52</tomcat-jdbc.version>
-        <jetty.version>9.4.40.v20210413</jetty.version>
+        
         <skip.karaf.featureTest>true</skip.karaf.featureTest>
         <dependency-list.file>direct-dependencies.txt</dependency-list.file>
     </properties>
diff --git a/oparent/pom.xml b/oparent/pom.xml
index f300f9cd..28069366 100755
--- a/oparent/pom.xml
+++ b/oparent/pom.xml
@@ -77,6 +77,8 @@
         <ccsdk.sli.plugins.version>${ccsdk.sli.version}</ccsdk.sli.plugins.version>
         <ccsdk.distribution.version>1.1.1-SNAPSHOT</ccsdk.distribution.version>
 
+        <log4j.version>2.15.0</log4j.version>
+        <log4j2.version>2.15.0</log4j2.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <fasterxml.jackson.version>2.10.5</fasterxml.jackson.version>
         <velocity.version>2.3</velocity.version>
diff --git a/springboot/spring-boot-setup/src/main/resources/pom-template.xml b/springboot/spring-boot-setup/src/main/resources/pom-template.xml
index 0271683d..25b52763 100644
--- a/springboot/spring-boot-setup/src/main/resources/pom-template.xml
+++ b/springboot/spring-boot-setup/src/main/resources/pom-template.xml
@@ -130,6 +130,8 @@
         <jersey.version>${springboot.jersey.version}</jersey.version>
         <jersey.client.version>${springboot.jersey.version}</jersey.client.version>
         <jettison.version>1.3.8</jettison.version>
+        <log4j.version>2.15.0</log4j.version>
+        <log4j2.version>2.15.0</log4j2.version>
         <logback.version>1.2.3</logback.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <mariadb4j.version>2.4.0</mariadb4j.version>
diff --git a/springboot/springboot1/pom.xml b/springboot/springboot1/pom.xml
index 669736eb..81ae5726 100644
--- a/springboot/springboot1/pom.xml
+++ b/springboot/springboot1/pom.xml
@@ -130,6 +130,8 @@
         <jersey.version>2.30.1</jersey.version>
         <jersey.client.version>2.30.1</jersey.client.version>
         <jettison.version>1.3.8</jettison.version>
+        <log4j.version>2.15.0</log4j.version>
+        <log4j2.version>2.15.0</log4j2.version>
         <logback.version>1.2.3</logback.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <mariadb4j.version>2.4.0</mariadb4j.version>
diff --git a/springboot/springboot2/pom.xml b/springboot/springboot2/pom.xml
index 4451ccf2..0915673c 100644
--- a/springboot/springboot2/pom.xml
+++ b/springboot/springboot2/pom.xml
@@ -130,6 +130,8 @@
         <jersey.version>2.30.1</jersey.version>
         <jersey.client.version>2.30.1</jersey.client.version>
         <jettison.version>1.3.8</jettison.version>
+        <log4j.version>2.15.0</log4j.version>
+        <log4j2.version>2.15.0</log4j2.version>
         <logback.version>1.2.3</logback.version>
         <mariadb.connector.version>2.7.3</mariadb.connector.version>
         <mariadb4j.version>2.4.0</mariadb4j.version>
diff --git a/standalone/pom.xml b/standalone/pom.xml
index e0faa1ec..da8c76eb 100755
--- a/standalone/pom.xml
+++ b/standalone/pom.xml
@@ -65,6 +65,8 @@
         <bundle.plugin.version>2.5.0</bundle.plugin.version>
         <checkstyle.skip>true</checkstyle.skip>
 
+        <log4j.version>2.15.0</log4j.version>
+        <log4j2.version>2.15.0</log4j2.version>
         <mariadb.connector.version>2.7.2</mariadb.connector.version>
         <fasterxml.jackson.version>2.12.4</fasterxml.jackson.version>
         <velocity.version>2.3</velocity.version>
@@ -102,7 +104,7 @@
             <dependency>
                 <groupId>org.apache.logging.log4j</groupId>
                 <artifactId>log4j-slf4j-impl</artifactId>
-                <version>2.11.2</version>
+                <version>2.15.0</version>
             </dependency>
             <dependency>
                 <groupId>com.fasterxml.jackson.core</groupId>
-- 
2.16.6