fix: SEC-1034: log4j migration to confluent repackaged version (#5783)

confluentinc · Jul 9, 2020 · 4563d02 · 4563d02
1 parent dfb2cbf
commit 4563d02
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/pom.xml b/pom.xml
@@ -490,6 +490,11 @@
             <groupId>org.slf4j</groupId>
             <artifactId>slf4j-log4j12</artifactId>
         </dependency>
+        <!-- Use a repackaged version of log4j with security patches. Default log4j v1.2 is a transitive dependency of slf4j-log4j12, but it is excluded in common/pom.xml -->
+        <dependency>
+            <groupId>io.confluent</groupId>
+            <artifactId>confluent-log4j</artifactId>
+        </dependency>
     </dependencies>
 
     <build>