[CONNECTORS-1683] Upgrade Log4J 2.17.0

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: ManifoldCF 2.20
• Fix Version/s: ManifoldCF 2.21
• Component/s: Framework core
• Labels: CVE-2021-44228 CVE-2021-45046 CVE-2021-45105 security vulnerabilities
• Assignee: Markus Schuch
• Reporter: Markus Schuch
• Created: 10/Dec/21 15:27
• Updated: 19/Dec/21 13:24
• Resolved: 19/Dec/21 13:24

Description

Dependency Log4j 2 should be upgraded to Log4J 2.16.0, because there is a known RCE Vulnerability in previous Versions: https://www.lunasec.io/docs/blog/log4j-zero-day/

CVE-2021-44228
CVE-2021-45046
CVE-2021-45105