[MNG-7366] Maven downloading log4j version not specified in POM when building the Project.

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Invalid
• Affects Version/s: 3.8.4
• Component/s: Artifacts and Repositories, Dependencies
• Flags: Patch, Important

Language

Java

• Assignee: Unassigned
• Reporter: Srinivasan L
• Created: 16/Dec/21 09:49
• Updated: 10/Jan/22 08:14
• Resolved: 16/Dec/21 09:58

Description

Maven downloading log4j version not specified in POM when building the Project.

In POM i have updated my log4j to log4j core 2.16.0 to fix the Log4j Vulnerability with Older version. But even after changing the Version Maven is downloading 1.2.12 and 1.2.17 version of Log4j when running the build.

I'm not seeing these version even in the dependency tree of my Project. 

Please help to fix this issue as its a Critical Security Issue.

Issue Links

• is duplicated by: MNG-7387 Log4j1.2.12 dependency is getting downloading from Maven Project