diff --git a/documentation/whats-new.md b/documentation/whats-new.md index 65f4dd59ec..2d384aace7 100644 --- a/documentation/whats-new.md +++ b/documentation/whats-new.md @@ -6,6 +6,9 @@ --> > Subscribe to [mystudies-announce@googlegroups.com](https://groups.google.com/g/mystudies-announce/) to receive release notifications and announcements +# Release 2.0.9 +* This release fixes the security vulnerability detected with Log4j recently. More information on the vulnerability is here (https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45046). +* Note: The platform was using a log4j version and logging framework which is not impacted by this vulnerability. However, as a safety measure, the platform is updated with release v2.0.9, to use the latest Log4j version 2.16.0 that was provided by Apache to address this issue. # Release 2.0.8 * Note: This release requires users to update to new versions of the mobile apps from the app stores. diff --git a/participant-datastore/consent-mgmt-module/consent-mgmt/pom.xml b/participant-datastore/consent-mgmt-module/consent-mgmt/pom.xml index d3e861df6e..4de833a604 100644 --- a/participant-datastore/consent-mgmt-module/consent-mgmt/pom.xml +++ b/participant-datastore/consent-mgmt-module/consent-mgmt/pom.xml @@ -66,11 +66,26 @@ - - org.springframework.boot - spring-boot-starter-log4j2 - - + + org.springframework.boot + spring-boot-starter-log4j2 + + + org.apache.logging.log4j + log4j-core + + + + + org.apache.logging.log4j + log4j-core + 2.16.0 + + + org.apache.logging.log4j + log4j-api + 2.16.0 + org.springframework.boot spring-boot-devtools diff --git a/participant-datastore/enroll-mgmt-module/enroll-mgmt/pom.xml b/participant-datastore/enroll-mgmt-module/enroll-mgmt/pom.xml index 0314d586c6..027c2a059e 100644 --- a/participant-datastore/enroll-mgmt-module/enroll-mgmt/pom.xml +++ b/participant-datastore/enroll-mgmt-module/enroll-mgmt/pom.xml @@ -42,10 +42,26 @@ org.springframework.boot spring-boot-starter-data-jpa - - org.springframework.boot - spring-boot-starter-log4j2 - + + org.springframework.boot + spring-boot-starter-log4j2 + + + org.apache.logging.log4j + log4j-core + + + + + org.apache.logging.log4j + log4j-core + 2.16.0 + + + org.apache.logging.log4j + log4j-api + 2.16.0 + org.springframework.boot spring-boot-starter-jdbc diff --git a/participant-datastore/user-mgmt-module/user-mgmt/pom.xml b/participant-datastore/user-mgmt-module/user-mgmt/pom.xml index fde2d9fed6..f5247367b5 100644 --- a/participant-datastore/user-mgmt-module/user-mgmt/pom.xml +++ b/participant-datastore/user-mgmt-module/user-mgmt/pom.xml @@ -64,10 +64,26 @@ - - org.springframework.boot - spring-boot-starter-log4j2 - + + org.springframework.boot + spring-boot-starter-log4j2 + + + org.apache.logging.log4j + log4j-core + + + + + org.apache.logging.log4j + log4j-core + 2.16.0 + + + org.apache.logging.log4j + log4j-api + 2.16.0 + org.springframework.boot spring-boot-devtools @@ -84,10 +100,6 @@ mysql-connector-java runtime - - org.slf4j - slf4j-ext - org.springframework.boot spring-boot-starter-tomcat diff --git a/study-builder/fdahpStudyDesigner/pom.xml b/study-builder/fdahpStudyDesigner/pom.xml index 5f454c559a..01580d0a47 100644 --- a/study-builder/fdahpStudyDesigner/pom.xml +++ b/study-builder/fdahpStudyDesigner/pom.xml @@ -197,25 +197,6 @@ 1.5.3 true - - log4j - log4j - 1.2.17 - - - com.sun.jmx - jmxri - - - com.sun.jdmk - jmxtools - - - javax.jms - jms - - - javax.servlet jstl diff --git a/study-builder/fdahpStudyDesigner/src/main/resources/application.properties b/study-builder/fdahpStudyDesigner/src/main/resources/application.properties index 93fc130185..fed6e60afd 100644 --- a/study-builder/fdahpStudyDesigner/src/main/resources/application.properties +++ b/study-builder/fdahpStudyDesigner/src/main/resources/application.properties @@ -58,7 +58,7 @@ security.oauth2.client.client-secret=${SECRET_KEY} # application version applicationVersion=1.0 -release.version=2.0.8 +release.version=2.0.9 security.oauth2.token_endpoint=${SCIM_AUTH_URL}/oauth2/token security.oauth2.client.redirect-uri=${SCIM_AUTH_URL}/callback diff --git a/study-datastore/pom.xml b/study-datastore/pom.xml index 544562ef5e..743910d344 100644 --- a/study-datastore/pom.xml +++ b/study-datastore/pom.xml @@ -207,25 +207,6 @@ jar compile - - log4j - log4j - 1.2.17 - - - com.sun.jmx - jmxri - - - com.sun.jdmk - jmxtools - - - javax.jms - jms - - - org.quartz-scheduler quartz