From 4563d026f144f07cfc01f391717a9da61c9a454a Mon Sep 17 00:00:00 2001
From: Nitesh Mor <niteshmor@users.noreply.github.com>
Date: Thu, 9 Jul 2020 16:22:10 -0700
Subject: [PATCH] fix: SEC-1034: log4j migration to confluent repackaged
 version (#5783)

---
 pom.xml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pom.xml b/pom.xml
index 002fbc323360..45c1caab6018 100644
--- a/pom.xml
+++ b/pom.xml
@@ -490,6 +490,11 @@
             <groupId>org.slf4j</groupId>
             <artifactId>slf4j-log4j12</artifactId>
         </dependency>
+        <!-- Use a repackaged version of log4j with security patches. Default log4j v1.2 is a transitive dependency of slf4j-log4j12, but it is excluded in common/pom.xml -->
+        <dependency>
+            <groupId>io.confluent</groupId>
+            <artifactId>confluent-log4j</artifactId>
+        </dependency>
     </dependencies>
 
     <build>