[MNEMONIC-723] Upgrade log4j version from 1.x to v2 for security vulnerability fixes

• Type: Task
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 0.17.0
• Fix Version/s: 0.17.0
• Component/s: Logging
• Assignee: Yanhui Zhao
• Reporter: Yanhui Zhao
• Created: 17/Feb/22 22:04
• Updated: 15/Apr/22 04:55
• Resolved: 15/Apr/22 04:54

Description

TLDR: Apache Log4j 1.x does have vulnerabilities that are unpatched. Many configurations are not impacted by the vulnerabilities by default. Log4j 1.x is EOL so there are no fixed 1.x versions. You can patch the jar files yourself by removing the vulnerable class files. It's not a simple upgrade to go from Log4j 1.x to 2.x in most cases.

 

According to the statement above, we need to upgrade our current log4j version from v1.x to v2.x

Sub-Tasks

• Update pom file reflecting the log4jv2 update dependencies change: Closed
• Update log4j.properties in each subproject folders with log4j2.xml: Closed
• Configure the log4jv2.xml with correct settings that align with current log4jv1 settings: Closed
• Making the log4j related version configurable: Closed
• Update log4j modules for Gradle build system: Closed