[XMLBEANS-580] upgrade to log4j 2.17.1

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: Version 5.0.3
• Component/s: DOM
• Assignee: PJ Fanning
• Reporter: PJ Fanning
• Created: 12/Dec/21 09:32
• Updated: 29/Dec/21 11:20
• Resolved: 27/Dec/21 13:59

Description

Users are encouraged to update their own log4j dependencies to the latest v2 available - currently 2.17.1 - the next xmlbeans release will use the latest available - xmlbeans only depends on log4j-api jar and the Log4Shell issue is in log4j-core jar.

https://logging.apache.org/log4j/2.x/security.html