From 6e73a883971fd4101b106a7439cb38edb2a93ba8 Mon Sep 17 00:00:00 2001
From: yeikel <email@yeikel.com>
Date: Mon, 13 Jan 2025 21:12:25 -0500
Subject: [PATCH] BE: upgrade logback to 1.5.16

---
 api/pom.xml | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/api/pom.xml b/api/pom.xml
index dc774c09a..a71b9402f 100644
--- a/api/pom.xml
+++ b/api/pom.xml
@@ -18,6 +18,8 @@
         <sonar.jacoco.reportPath>${project.basedir}/target/jacoco.exec</sonar.jacoco.reportPath>
         <sonar.coverage.jacoco.xmlReportPaths>${project.basedir}/target/site/jacoco/jacoco.xml</sonar.coverage.jacoco.xmlReportPaths>
         <sonar.language>java</sonar.language>
+        <!-- Temporary overwrite to fix CVE-2024-12798 and CVE-2024-12801. Remove after Spring > 3.4.1 is released  -->
+        <logback.version>1.5.16</logback.version>
     </properties>
 
     <dependencies>
@@ -115,9 +117,31 @@
             <version>${avro.version}</version>
         </dependency>
 
+        <dependency>
+            <groupId>ch.qos.logback</groupId>
+            <artifactId>logback-core</artifactId>
+            <version>${logback.version}</version>
+        </dependency>
+
+        <dependency>
+            <groupId>ch.qos.logback</groupId>
+            <artifactId>logback-classic</artifactId>
+            <version>${logback.version}</version>
+        </dependency>
+
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-logging</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>ch.qos.logback</groupId>
+                    <artifactId>logback-classic</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>ch.qos.logback</groupId>
+                    <artifactId>logback-core</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
 
         <dependency>