Upgrade org.apache.logging.log4j:log4j-core and log4j-api libraries i…

…n presto Upgraded org.apache.logging.log4j:log4j-core from 2.17.1 to 2.24.3 Upgraded org.apache.logging.log4j:log4j-api from 2.17.1 to 2.24.3 Fixes almost 25 CVEs.
prestodb · Feb 12, 2025 · 792118c · 792118c
1 parent 903520c
commit 792118c
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 6 deletions.
diff --git a/pom.xml b/pom.xml
@@ -103,6 +103,7 @@
         <air.test.thread-count>2</air.test.thread-count>
         <air.test.jvmsize>4g</air.test.jvmsize>
         <grpc.version>1.68.0</grpc.version>
+        <dep.log4j.version>2.24.3</dep.log4j.version>
 
         <air.javadoc.lint>-missing</air.javadoc.lint>
     </properties>
@@ -233,6 +234,20 @@
                 <scope>import</scope>
             </dependency>
 
+            <dependency>
+                <groupId>org.apache.logging.log4j</groupId>
+                <artifactId>log4j-api</artifactId>
+                <version>${dep.log4j.version}</version>
+                <scope>runtime</scope>
+            </dependency>
+
+            <dependency>
+                <groupId>org.apache.logging.log4j</groupId>
+                <artifactId>log4j-core</artifactId>
+                <version>${dep.log4j.version}</version>
+                <scope>runtime</scope>
+            </dependency>
+
             <dependency>
                 <groupId>io.netty</groupId>
                 <artifactId>netty-transport</artifactId>

diff --git a/presto-druid/pom.xml b/presto-druid/pom.xml
@@ -13,7 +13,6 @@
 
     <properties>
         <air.main.basedir>${project.parent.basedir}</air.main.basedir>
-        <dep.log4j.version>2.17.1</dep.log4j.version>
     </properties>
 
     <repositories>
@@ -178,14 +177,12 @@
         <dependency>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-api</artifactId>
-            <version>${dep.log4j.version}</version>
             <scope>runtime</scope>
         </dependency>
 
         <dependency>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-core</artifactId>
-            <version>${dep.log4j.version}</version>
             <scope>runtime</scope>
         </dependency>
 

diff --git a/presto-elasticsearch/pom.xml b/presto-elasticsearch/pom.xml
@@ -12,7 +12,6 @@
 
     <properties>
         <air.main.basedir>${project.parent.basedir}</air.main.basedir>
-        <dep.log4j.version>2.17.1</dep.log4j.version>
         <dep.elasticsearch.version>6.0.0</dep.elasticsearch.version>
     </properties>
 
@@ -173,14 +172,12 @@
         <dependency>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-api</artifactId>
-            <version>${dep.log4j.version}</version>
             <scope>runtime</scope>
         </dependency>
 
         <dependency>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-core</artifactId>
-            <version>${dep.log4j.version}</version>
             <scope>runtime</scope>
         </dependency>