Last active
May 15, 2023 15:46
-
-
Save gunnarmorling/8026d004776313ebfc65674202134e6d to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<!-- plug-in configuration to put into your parent POM for avoiding any usages of | |
outdated log4j2 versions, some of which are subject to the RCE CVE-2021-44228 | |
("Log4Shell"), CVE-2021-45046, and CVE-2021-45105. Make sure to check for the | |
latest version of log4j2 at | |
https://mvnrepository.com/artifact/org.apache.logging.log4j/log4j-core --> | |
... | |
<plugin> | |
<groupId>org.apache.maven.plugins</groupId> | |
<artifactId>maven-enforcer-plugin</artifactId> | |
<version>3.0.0</version> | |
<executions> | |
<execution> | |
<id>ban-bad-log4j-versions</id> | |
<phase>validate</phase> | |
<goals> | |
<goal>enforce</goal> | |
</goals> | |
<configuration> | |
<rules> | |
<bannedDependencies> | |
<excludes> | |
<exclude>org.apache.logging.log4j:log4j-core:(,2.17.0)</exclude> | |
</excludes> | |
</bannedDependencies> | |
</rules> | |
<fail>true</fail> | |
</configuration> | |
</execution> | |
</executions> | |
</plugin> | |
... |
@gunnarmorling I can only get this to work if I use brackets instead of parenthesis, i.e.
<exclude>org.apache.logging.log4j:log4j-core:[,2.16.0]</exclude>
instead of
<exclude>org.apache.logging.log4j:log4j-core:(,2.16.0)</exclude>
The documentation at https://maven.apache.org/enforcer/enforcer-rules/bannedDependencies.html also seems to indicate that without being completely explicit
You might want to update your snippet to exclude 2.17.0 as well ? Apache has released 2.17.1 , as new CVE is disclosed by Apache CVE-2021-44832,Fixed in Log4j 2.17.1
https://logging.apache.org/log4j/2.x/security.html
Adding to what @vegegoku reference posted:
Here is a link which might be helpful for Gradle projects
https://blog.gradle.org/log4j-vulnerability
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Updated to 2.17.0.