(tika) 01/03: TIKA-4162: add logback to dependencyManagement to avoid CVE-2023-6378

[ti...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

tilman pushed a commit to branch branch_2x
in repository https://gitbox.apache.org/repos/asf/tika.git

commit 19aa55687679afcbe7a835337bfb38411a146ace
Author: Tilman Hausherr <ti...@apache.org>
AuthorDate: Fri Dec 1 09:37:33 2023 +0100

    TIKA-4162: add logback to dependencyManagement to avoid CVE-2023-6378
---
 tika-parent/pom.xml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/tika-parent/pom.xml b/tika-parent/pom.xml
index 6099aa228..c26525179 100644
--- a/tika-parent/pom.xml
+++ b/tika-parent/pom.xml
@@ -408,6 +408,7 @@
     <kafka.version>3.6.0</kafka.version>
     <netty.version>4.1.101.Final</netty.version>
     <snappy.java.version>1.1.10.5</snappy.java.version>
+    <logback.version>1.4.13</logback.version>
   </properties>
 
   <dependencyManagement>
@@ -961,6 +962,17 @@
         <artifactId>maven-plugin-annotations</artifactId>
         <version>3.10.2</version>
       </dependency>
+      <!-- for zookeeper to avoid CVE-2023-6378 -->
+      <dependency>
+          <groupId>ch.qos.logback</groupId>
+          <artifactId>logback-core</artifactId>
+          <version>${logback.version}</version>
+      </dependency>
+      <dependency>
+          <groupId>ch.qos.logback</groupId>
+          <artifactId>logback-classic</artifactId>
+          <version>${logback.version}</version>
+      </dependency>
     </dependencies>
   </dependencyManagement>