[GROOVY-10408] Bump log4j2 version to 2.15.0 (test dependency)

• Type: Dependency upgrade
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.0.10, 4.0.0-rc-2
• Assignee: Paul King
• Reporter: Paul King
• Created: 10/Dec/21 21:17
• Updated: 03/Feb/22 22:29
• Resolved: 10/Dec/21 22:07

Description

Groovy doesn't bundle a version of Log4j in its distribution nor list it as a dependency in its pom (or bom), so isn't directly affected by CVE-2021-44228 (see https://logging.apache.org/log4j/2.x/security.html).

However Groovy users using the Log4j2 AST transform (or using Log4j2 directly) may wish to update there version of Log4j or note the security workarounds mentioned in the above security vulnerability link.

See also:

• LOG4J2-3201 Limit the protocols JNDI can use and restrict LDAP
• LOG4J2-3198 Message lookups should be disabled by default
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228

Issue Links

• relates to: GROOVY-10410 Bump log4j2 version to 2.16.0 (test dependency)