Remove default log4j version and add a new version globally

[heshkaru]

Hi,

Currently talend uses log4j 2.12 version which has the latest vulnerability discovered. As I can see for each job there is a separate POM file and all those files are using that log4j version. Do I need to manually go to each and every POM file and change it or is there a easy way to change this version to new log4j 2.17.1 version.

https://www.secureworks.com/blog/log4j-vulnerability-faqs# :~:text=rated%20moderate%20severity.-,Version%202.17.,was%20disclosed%20on%20December%2016.

Thank you

[toshi1]

Hello, -> all is fixed

1st, Thanks for the nice and quick reply from @Heshan Karunaratne​ - It saved me, and helped a lot.

2nd. For those out there who also struggle with the security themes of log4j 1.x and 2.x hereafter my crucial points that have brought success.

1) I'd to understand the substitution from - to with the bridging libs

• s.a. slf4j-log4j bridge with log4j 2.8.1 siehe Antwort
  • slf4j-log4j12 Bridge -> altes Binding -> neues: log4j-slf4j-impl
    • log4j-api (2.8.1)
    • log4j-core (2.8.1)
    • log4j-slf4j-impl (2.8.1)
    • slf4j-api (1.7.25)
    • zusätzlich Bridge to log4j
      • log4j-1.2-api (2.8.1)
• Benötigte Bibliotheken von SLF4J und Log4j 2.x -> in MVN log4j aktuelle Versionsstände ermitteln
  • 2.17.2
    • log4j-core
    • log4j-api
    • log4j-slf4j-impl
      • Log4j 2 SLF4J Binding
        • log4j-slf4j-impl should be used with SLF4J 1.7.x releases or older.
        • log4j-slf4j18-impl should be used with SLF4J 1.8.x releases or newer.
        • NOTE not to take simultanously log4j-to-slf4j-2.0.jar
    • log4j-1.2-api
  • 1.7.36
    • slf4j-api

2) I'd to learn, that with my old TOS BD 7.2.1 success is to difficult to achieve

I'm exported the TOS BD 7.2.1 items and import them to TOS DI 8.0.1, that helped me a lot.

I wish to Thanks all of you, you're a great community

Torsten

[heshkaru]

My pleasure