Merge pull request #1383 from Alfresco/fix/log4j-fix

Fix log4j security vulnerability reported by quay.io. [skip tests]

pom.xml

@@ -251,5 +251,10 @@
         <version>1.0.0</version>
         <scope>provided</scope>
       </dependency>
+       <dependency>
+           <groupId>ch.qos.reload4j</groupId>
+           <artifactId>reload4j</artifactId>
+           <version>1.2.18.3</version>
+       </dependency>
    </dependencies>
 </project>

search-services/alfresco-search/pom.xml

@@ -21,6 +21,10 @@
                     <artifactId>servlet-api</artifactId>
                     <groupId>javax.servlet</groupId>
                 </exclusion>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
 
@@ -42,6 +46,10 @@
                     <groupId>jdk.tools</groupId>
                     <artifactId>jdk.tools</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
 
@@ -50,6 +58,12 @@
             <artifactId>solr-analysis-extras</artifactId>
             <version>${solr.version}</version>
             <scope>provided</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
 
         <dependency>
@@ -74,6 +88,10 @@
                 	<groupId>org.bouncycastle</groupId>
                 	<artifactId>bcprov-jdk15on</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
 
@@ -87,6 +105,10 @@
                     <groupId>org.simpleframework</groupId>
                     <artifactId>simple-xml</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
         <!-- replace simple-xml from solr-clustering with simple-xml-safe -->
@@ -105,7 +127,7 @@
 
         <dependency>
             <groupId>org.slf4j</groupId>
-            <artifactId>slf4j-log4j12</artifactId>
+            <artifactId>slf4j-reload4j</artifactId>
             <version>${slf4j.version}</version>
         </dependency>
 
@@ -232,6 +254,12 @@
             <artifactId>solr-test-framework</artifactId>
             <version>${solr.version}</version>
             <scope>test</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>com.carrotsearch.randomizedtesting</groupId>

search-services/alfresco-solrclient-lib/pom.xml

@@ -20,8 +20,14 @@
             <groupId>org.alfresco</groupId>
             <artifactId>alfresco-data-model</artifactId>
             <version>${dependency.alfresco-data-model.version}</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
-        
+
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-core</artifactId>
@@ -66,8 +72,8 @@
         </dependency>
         <dependency>
             <groupId>org.slf4j</groupId>
-            <artifactId>slf4j-log4j12</artifactId>
-            <version>1.7.30</version>
+            <artifactId>slf4j-reload4j</artifactId>
+            <version>1.7.36</version>
         </dependency>
     </dependencies>
 

search-services/packaging/src/main/resources/licenses/notice.txt

@@ -109,6 +109,7 @@ org.restlet.ext.servlet-2.3.12.jar https://github.com/restlet/restlet-framework-
 xercesImpl-2.11.0-alfresco-patched-20180402.jar http://www.apache.org/licenses/LICENSE-2.0.txt
 xml-apis-1.4.01.jar http://www.apache.org/licenses/LICENSE-2.0.txt
 simple-xml-safe-2.7.1.jar https://github.com/carrotsearch/simplexml-safe/blob/release/2.7.1/LICENSE.txt
+reload4j-1.2.18.3.jar http://www.apache.org/licenses/LICENSE-2.0.txt
 
 
 === Creative Commons Public Domain ===

search-services/pom.xml

@@ -14,7 +14,7 @@
     <packaging>pom</packaging>
     <name>Alfresco Solr Search parent</name>
     <properties>
-        <slf4j.version>1.7.30</slf4j.version>
+        <slf4j.version>1.7.36</slf4j.version>
         <cxf.version>3.2.14</cxf.version>
         <licenseName>community</licenseName>
     </properties>