[SHIRO-842] shiro-web depends on older log4j

• Type: Dependency upgrade
• Status: Resolved
• Priority: Major
• Resolution: Resolved
• Affects Version/s: 1.8.0
• Fix Version/s: 2.0.0-alpha, 1.9.0
• Component/s: Web
• Assignee: Benjamin Marwell
• Reporter: Lenny Primak
• Created: 14/Jan/22 03:30
• Updated: 27/Jan/22 20:55
• Resolved: 27/Jan/22 20:54

Description

shiro-web has a very old log4j dependency  (log4j:log4j)

Snyk is reporting as a critical security issue (not sure it's actually is)

Shiro should upgrade to the latest 1.x (or 2.x) if necessary

Issue Links

• is duplicated by: SHIRO-847 Log4j 1.x 版本的CVE-2022-23302/23305/23307在Apache Shiro 1.8.0版本是否受影响
• links to: GitHub Pull Request #335