[LOG4J2-3218] Upgrade log4j2 dependency version in the kotlin logging API for CVE-2021-44228, CVE-2021-45046, CVE-2021-45105

• Type: Dependency upgrade
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Kotlin 1.1.0
• Fix Version/s: Kotlin 1.2.0
• Component/s: Kotlin API
• Assignee: Matt Sicker
• Reporter: Raman Gupta
• Created: 13/Dec/21 14:10
• Updated: 21/Dec/21 03:49
• Resolved: 21/Dec/21 03:49

Description

Kotlin API currently depends on log4j2 API version 2.13.2 which, assuming users are using the corresponding implementation, is vulnerable by default to CVE-2021-44228, CVE-2021-45046, and CVE-2021-45105. Update dependency to 2.17.0.