Bump Log4j to 2.16.0 to mitigate CVE-2021-44228.

d2iq-archive · Dec 17, 2021 · 77334ea · 77334ea
1 parent a7d4f92
commit 77334ea
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/sdk/scheduler/build.gradle b/sdk/scheduler/build.gradle
@@ -163,8 +163,8 @@ dependencies {
     compile 'io.prometheus:simpleclient_dropwizard:0.0.26'
     compile 'io.prometheus:simpleclient_servlet:0.0.26'
     compile 'com.readytalk:metrics3-statsd:4.2.0'
-    compile 'org.apache.logging.log4j:log4j-core:2.8.1'
-    compile 'org.apache.logging.log4j:log4j-slf4j-impl:2.8.1'
+    compile 'org.apache.logging.log4j:log4j-core:2.16.0'
+    compile 'org.apache.logging.log4j:log4j-slf4j-impl:2.16.0'
 
     testCompile 'org.hamcrest:hamcrest-all:1.3' // note: must be above junit
     testCompile 'junit:junit:4.12'