Netflix / photon

Photon is a Java implementation of the Interoperable Master Format (IMF) standard. IMF is a SMPTE standard whose core constraints are defined in the specification st2067-2:2013
Apache License 2.0
237 stars 77 forks source link

replace log4j12 (1.2.17) with log4j 2.17.2 #299

Closed cconcolato closed 2 years ago

cconcolato commented 2 years ago

This PR solely updates log4j to the latest version. Note that the current version of Photon is not impacted by Log4Shell security issue because it currently uses Log4j version 1.2.17 and Log4Shell only affects version 2.0-beta9 to 2.15. However, there are other vulnerabilities in Log4j version 1.2 and the Apache Foundation https://logging.apache.org/log4j/1.2/ says "Users are urged to upgrade to Log4j 2."