[SAMZA-2683] Bump up Scalatra version to pull latest dependencies

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.6
• Fix Version/s: 1.7
• Assignee: Daniel Chen
• Reporter: Daniel Chen
• Created: 30/Aug/21 11:23
• Updated: 01/Oct/21 21:16
• Resolved: 01/Oct/21 21:16

Description

Scalatra 2.5.0 is pulling in outdated libraries, namely log4j:1.2.14 which possesses security concerns:

"Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17. Users are advised to migrate to `org.apache.logging.log4j:log4j-core` remediation: No fix is known for this vulnerability"

The latest Scalatra 2.7.1 version no longer depends on this dangerous library