[NUTCH-2915] Upgrade to log4j 2.15.0

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 1.19
• Fix Version/s: 1.19
• Component/s: logging
• Assignee: Sebastian Nagel
• Reporter: Sebastian Nagel
• Created: 12/Dec/21 19:56
• Updated: 13/Mar/24 14:50
• Resolved: 14/Dec/21 16:30

Description

See Apache Log4j Security Vulnerabilities.

Notes:

• the released 1.18 is not directly affected because it uses log4j 1.x which is not affected by CVE-2021-44228. The upgrade from log4j 1.x to 2.14.1 was done recently by NUTCH-2885.
• the plugin indexer-elastic includes a transitive dependency to log4j-api-2.11.1 which is not affected - only log4j-core is according to comments by slf4j.

Issue Links

• links to: Github PR #713
• links to: GitHub Pull Request #713