You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@grails.apache.org by ja...@apache.org on 2026/07/22 20:26:46 UTC
(grails-core) 01/01: Update Log4j to 2.25.5 and document unfixed Jansi CVE
This is an automated email from the ASF dual-hosted git repository.
jamesfredley pushed a commit to branch deps/cve-log4j-jansi-7.0.x
in repository https://gitbox.apache.org/repos/asf/grails-core.git
commit 23c2c586af3dd80c7cc47b057cb9f38e51f80576
Author: James Fredley <ja...@users.noreply.github.com>
AuthorDate: Wed Jul 22 16:25:27 2026 -0400
Update Log4j to 2.25.5 and document unfixed Jansi CVE
Override Spring Boot 3.5.16's Log4j 2.24.3 management through the
Grails BOM to remediate CVE-2026-49844.
Exclude the exact managed Jansi 1.18 coordinate from OSS Index because
CVE-2026-8484 affects every available release and has no upstream fix.
Assisted-by: opencode:gpt-5.6-sol codegraph
---
.../org/apache/grails/buildsrc/VulnerabilityScanPlugin.groovy | 5 +++++
dependencies.gradle | 9 +++++++++
2 files changed, 14 insertions(+)
diff --git a/build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/VulnerabilityScanPlugin.groovy b/build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/VulnerabilityScanPlugin.groovy
index 2a51c1b83e..22a374e8c9 100644
--- a/build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/VulnerabilityScanPlugin.groovy
+++ b/build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/VulnerabilityScanPlugin.groovy
@@ -64,6 +64,11 @@ class VulnerabilityScanPlugin implements Plugin<Project> {
'org.hibernate:hibernate-core:5.6.11.Final',
// CVE-2018-14335: Sonatype flags this against all H2 versions; no upstream fix exists.
'com.h2database:h2:2.4.240',
+ // CVE-2026-8484: org.fusesource.jansi is unmaintained; all versions through 2.4.3 are flagged and no
+ // fixed release exists upstream. Grails still uses the fusesource coordinate for ANSI console output
+ // (package org.fusesource.jansi). Remove once consumers migrate off fusesource jansi or a patched
+ // release ships.
+ 'org.fusesource.jansi:jansi:1.18',
// CVE-2026-14683/14684/14685/14686: pulled transitively via micrometer/actuator (LatencyUtils).
// The fix is HdrHistogram 2.2.3, which is not yet published to Maven Central (2.2.2 is the latest
// release). Remove this exclusion once 2.2.3+ is available and resolves on the classpath.
diff --git a/dependencies.gradle b/dependencies.gradle
index aae9349ee7..d8644ef417 100644
--- a/dependencies.gradle
+++ b/dependencies.gradle
@@ -87,6 +87,8 @@ ext {
'jackson.version' : '2.21.5',
// Security: overrides spring-boot-dependencies (1.5.34). 1.5.37 fixes CVE-2026-13006 flagged against logback-core.
'logback.version' : '1.5.37',
+ // Security: overrides spring-boot-dependencies (2.24.3). 2.25.5 fixes CVE-2026-49844 flagged against log4j-api.
+ 'log4j2.version' : '2.25.5',
'jquery.version' : '3.7.1',
'hibernate-groovy-proxy.version': '1.1',
'jakarta-servlet-api.version' : '6.1.0',
@@ -118,6 +120,7 @@ ext {
'asset-pipeline-bom': "cloud.wondrify:asset-pipeline-bom:${bomDependencyVersions['asset-pipeline-bom.version']}",
'spock-bom' : "org.spockframework:spock-bom:${bomDependencyVersions['spock.version']}",
'jackson-bom' : "com.fasterxml.jackson:jackson-bom:${bomDependencyVersions['jackson.version']}",
+ 'log4j2-bom' : "org.apache.logging.log4j:log4j-bom:${bomDependencyVersions['log4j2.version']}",
'groovy-bom' : "org.apache.groovy:groovy-bom:${bomDependencyVersions['groovy.version']}",
'junit-bom' : "org.junit:junit-bom:${bomDependencyVersions['junit.version']}",
'selenium-bom' : "org.seleniumhq.selenium:selenium-bom:${bomDependencyVersions['selenium.version']}",
@@ -173,6 +176,12 @@ ext {
// Security override of spring-boot-dependencies - see logback.version
'logback-classic' : "ch.qos.logback:logback-classic:${bomDependencyVersions['logback.version']}",
'logback-core' : "ch.qos.logback:logback-core:${bomDependencyVersions['logback.version']}",
+ // Security override of spring-boot-dependencies - see log4j2.version
+ 'log4j2-api' : "org.apache.logging.log4j:log4j-api:${bomDependencyVersions['log4j2.version']}",
+ 'log4j2-core' : "org.apache.logging.log4j:log4j-core:${bomDependencyVersions['log4j2.version']}",
+ 'log4j2-jul' : "org.apache.logging.log4j:log4j-jul:${bomDependencyVersions['log4j2.version']}",
+ 'log4j2-slf4j2-impl' : "org.apache.logging.log4j:log4j-slf4j2-impl:${bomDependencyVersions['log4j2.version']}",
+ 'log4j2-to-slf4j' : "org.apache.logging.log4j:log4j-to-slf4j:${bomDependencyVersions['log4j2.version']}",
// start - boot & selenium conflict, so pin the version we want (newest)
'jakarta-servlet-api' : "jakarta.servlet:jakarta.servlet-api:${bomDependencyVersions['jakarta-servlet-api.version']}",
'jakarta-validation-api' : "jakarta.validation:jakarta.validation-api:${bomDependencyVersions['jakarta-validation-api.version']}",