[skywalking] branch webapp-log4j created (now d2d0d7a)

[wu...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

wusheng pushed a change to branch webapp-log4j
in repository https://gitbox.apache.org/repos/asf/skywalking.git.


      at d2d0d7a  Update log4j2 version for webapp.

This branch includes the following new commits:

     new d2d0d7a  Update log4j2 version for webapp.

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

[skywalking] 01/01: Update log4j2 version for webapp.

[wu...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

wusheng pushed a commit to branch webapp-log4j
in repository https://gitbox.apache.org/repos/asf/skywalking.git

commit d2d0d7a5b3f8d605018d342b1b61f61ae2088598
Author: Wu Sheng <wu...@foxmail.com>
AuthorDate: Sun Dec 12 11:02:32 2021 +0800

    Update log4j2 version for webapp.
---
 CHANGES.md         | 7 +++++--
 apm-webapp/pom.xml | 2 +-
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/CHANGES.md b/CHANGES.md
index be28e3b..44a9847 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -7,8 +7,8 @@ Release Notes.
 
 #### Project
 
-* Upgrade log4j2 to 2.15.0 for easing the CVE concern. Officially, unless users open `level=DEBUG` for gRPC/HTTP
-  handler(s), no security error.
+* Upgrade log4j2 to 2.15.0 for CVE-2021-44228. This CVE only effects on JDK if JDNI is opened in default. Notice, using
+  JVM option `-Dlog4j2.formatMsgNoLookups=true` also avoids CVE if your JRE opened JNDI in default.
 
 #### OAP Server
 
@@ -18,6 +18,9 @@ Release Notes.
 
 #### UI
 
+* (UI Web Server)Upgrade log4j2 to 2.15.0 for CVE-2021-44228. This CVE only effects on JDK if JDNI is opened in default.
+  Notice, using JVM option `-Dlog4j2.formatMsgNoLookups=true` also avoids CVE if your JRE opened JNDI in default.
+
 #### Documentation
 
 All issues and pull requests are [here](https://github.com/apache/skywalking/milestone/112?closed=1)
diff --git a/apm-webapp/pom.xml b/apm-webapp/pom.xml
index 24abac6..76e9773 100644
--- a/apm-webapp/pom.xml
+++ b/apm-webapp/pom.xml
@@ -32,7 +32,7 @@
         <java.version>1.8</java.version>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <spring.boot.version>2.4.8</spring.boot.version>
-        <log4j.version>2.6.2</log4j.version>
+        <log4j.version>2.15.0</log4j.version>
         <gson.version>2.8.2</gson.version>
         <apache-httpclient.version>4.5.3</apache-httpclient.version>
         <spring-cloud-dependencies.version>2020.0.3</spring-cloud-dependencies.version>