BE: upgrade logback to 1.5.16

kafbat · Jan 14, 2025 · 6e73a88 · 6e73a88
1 parent 2b3abd2
commit 6e73a88
Showing 1 changed file with 24 additions and 0 deletions.
diff --git a/api/pom.xml b/api/pom.xml
@@ -18,6 +18,8 @@
         <sonar.jacoco.reportPath>${project.basedir}/target/jacoco.exec</sonar.jacoco.reportPath>
         <sonar.coverage.jacoco.xmlReportPaths>${project.basedir}/target/site/jacoco/jacoco.xml</sonar.coverage.jacoco.xmlReportPaths>
         <sonar.language>java</sonar.language>
+        <!-- Temporary overwrite to fix CVE-2024-12798 and CVE-2024-12801. Remove after Spring > 3.4.1 is released  -->
+        <logback.version>1.5.16</logback.version>
     </properties>
 
     <dependencies>
@@ -115,9 +117,31 @@
             <version>${avro.version}</version>
         </dependency>
 
+        <dependency>
+            <groupId>ch.qos.logback</groupId>
+            <artifactId>logback-core</artifactId>
+            <version>${logback.version}</version>
+        </dependency>
+
+        <dependency>
+            <groupId>ch.qos.logback</groupId>
+            <artifactId>logback-classic</artifactId>
+            <version>${logback.version}</version>
+        </dependency>
+
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-logging</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>ch.qos.logback</groupId>
+                    <artifactId>logback-classic</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>ch.qos.logback</groupId>
+                    <artifactId>logback-core</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
 
         <dependency>