From 07a139c927f3c4c6f57f5567b536cbaa9a89a44e Mon Sep 17 00:00:00 2001 From: Chris Beams Date: Mon, 20 Dec 2021 07:34:04 +0100 Subject: [PATCH] Upgrade log4j 2.15.0 => 2.17.0 This change upgrades log4j to patch fixes for recently documented CVE-2021-45046 CVE-2021-45105 vulnerabilities related to the Log4Shell exploit. Like the earlier fix, Bisq does not appear to be vulnerable to these exploits because it does not use log4j directly, only transitively depends on it. Nevertheless, the upgrade is still the safe bet. --- build.gradle | 2 +- gradle/verification-metadata.xml | 26 ++++++++++++++++++++++++++ 2 files changed, 27 insertions(+), 1 deletion(-) diff --git a/build.gradle b/build.gradle index f2fcab99b3..9a3d754f95 100644 --- a/build.gradle +++ b/build.gradle @@ -584,7 +584,7 @@ configure(project(':pricenode')) { "Implementation-Title": project.name, "Implementation-Version": version) - ext['log4j2.version'] = '2.15.0' + ext['log4j2.version'] = '2.17.0' dependencies { implementation project(":common") diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index 14358c550f..9e193a8ddf 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -1888,6 +1888,11 @@ + + + + + @@ -1912,6 +1917,14 @@ + + + + + + + + @@ -1922,6 +1935,11 @@ + + + + + @@ -1946,6 +1964,14 @@ + + + + + + + +