Update Log4J dependency to 2.16.0 (CVE-2021-44228)

Author: deki

aws-serverless-spring-archetype/src/main/resources/archetype-resources/build.gradle

@@ -10,11 +10,11 @@ dependencies {
           'org.springframework:spring-webmvc:5.3.9',
           'org.springframework:spring-context:5.3.9',
           'com.amazonaws.serverless:aws-serverless-java-container-spring:[1.0,)',
-          'org.apache.logging.log4j:log4j-core:2.14.1',
-          'org.apache.logging.log4j:log4j-api:2.14.1',
-          'org.apache.logging.log4j:log4j-slf4j-impl:2.14.1',
+          'org.apache.logging.log4j:log4j-core:2.16.0',
+          'org.apache.logging.log4j:log4j-api:2.16.0',
+          'org.apache.logging.log4j:log4j-slf4j-impl:2.16.0',
           'com.fasterxml.jackson.core:jackson-databind:2.12.4',
-          'com.amazonaws:aws-lambda-java-log4j2:1.1.0',
+          'com.amazonaws:aws-lambda-java-log4j2:1.3.0',
   )
 
   testImplementation("junit:junit:4.13.2")

aws-serverless-spring-archetype/src/main/resources/archetype-resources/pom.xml

@@ -18,7 +18,7 @@
         <maven.compiler.target>1.8</maven.compiler.target>
         <spring.version>5.3.9</spring.version>
         <junit.version>4.13.2</junit.version>
-        <log4j.version>2.14.1</log4j.version>
+        <log4j.version>2.16.0</log4j.version>
     </properties>
 
     <dependencies>
@@ -74,7 +74,7 @@
         <dependency>
             <groupId>com.amazonaws</groupId>
             <artifactId>aws-lambda-java-log4j2</artifactId>
-            <version>1.2.0</version>
+            <version>1.3.0</version>
         </dependency>
 
         <dependency>

aws-serverless-struts2-archetype/src/main/resources/archetype-resources/build.gradle

@@ -35,10 +35,10 @@ dependencies {
   }
   implementation ('org.hibernate:hibernate-validator:5.4.3.Final')
   implementation ('com.fasterxml.jackson.core:jackson-databind:2.12.4')
-  implementation ('org.apache.logging.log4j:log4j-core:2.14.1')
-  implementation ('org.apache.logging.log4j:log4j-api:2.14.1')
-  implementation ('org.apache.logging.log4j:log4j-slf4j-impl:2.14.1')
-  implementation ('com.amazonaws:aws-lambda-java-log4j2:1.2.0')
+  implementation ('org.apache.logging.log4j:log4j-core:2.16.0')
+  implementation ('org.apache.logging.log4j:log4j-api:2.16.0')
+  implementation ('org.apache.logging.log4j:log4j-slf4j-impl:2.16.0')
+  implementation ('com.amazonaws:aws-lambda-java-log4j2:1.3.0')
 
   testImplementation('junit:junit:4.13.2')
   testImplementation('org.apache.struts:struts2-junit-plugin:2.5.26') {

aws-serverless-struts2-archetype/src/main/resources/archetype-resources/pom.xml

@@ -18,7 +18,7 @@
         <struts2.version>2.5.26</struts2.version>
         <jackson.version>2.12.4</jackson.version>
         <junit.version>4.13.2</junit.version>
-        <log4j.version>2.14.1</log4j.version>
+        <log4j.version>2.16.0</log4j.version>
     </properties>
 
     <dependencies>
@@ -110,7 +110,7 @@
         <dependency>
             <groupId>com.amazonaws</groupId>
             <artifactId>aws-lambda-java-log4j2</artifactId>
-            <version>1.2.0</version>
+            <version>1.3.0</version>
         </dependency>
 
         <dependency>

samples/spring/pet-store/build.gradle

@@ -10,11 +10,11 @@ dependencies {
           'org.springframework:spring-webmvc:5.3.9',
           'org.springframework:spring-context:5.3.9',
           'com.amazonaws.serverless:aws-serverless-java-container-spring:[1.0,)',
-          'org.apache.logging.log4j:log4j-core:2.14.1',
-          'org.apache.logging.log4j:log4j-api:2.14.1',
-          'org.apache.logging.log4j:log4j-slf4j-impl:2.14.1',
+          'org.apache.logging.log4j:log4j-core:2.16.0',
+          'org.apache.logging.log4j:log4j-api:2.16.0',
+          'org.apache.logging.log4j:log4j-slf4j-impl:2.16.0',
           'com.fasterxml.jackson.core:jackson-databind:2.12.4',
-          'com.amazonaws:aws-lambda-java-log4j2:1.2.0',
+          'com.amazonaws:aws-lambda-java-log4j2:1.3.0',
   )
 }
 

samples/spring/pet-store/pom.xml

@@ -28,7 +28,7 @@
         <maven.compiler.target>1.8</maven.compiler.target>
         <spring.version>5.3.9</spring.version>
         <junit.version>4.13.2</junit.version>
-        <log4j.version>2.15.0</log4j.version>
+        <log4j.version>2.16.0</log4j.version>
     </properties>
 
     <dependencies>
@@ -90,7 +90,7 @@
         <dependency>
             <groupId>com.amazonaws</groupId>
             <artifactId>aws-lambda-java-log4j2</artifactId>
-            <version>1.2.0</version>
+            <version>1.3.0</version>
         </dependency>
 
         <dependency>

samples/struts2/pet-store/build.gradle

@@ -21,10 +21,10 @@ dependencies {
           'com.jgeppert.struts2:struts2-aws-lambda-support-plugin:1.3.0',
           'org.hibernate:hibernate-validator:5.4.3.Final',
           'com.fasterxml.jackson.core:jackson-databind:2.12.4',
-          'org.apache.logging.log4j:log4j-core:2.14.1',
-          'org.apache.logging.log4j:log4j-api:2.14.1',
-          'org.apache.logging.log4j:log4j-slf4j-impl:2.14.1',
-          'com.amazonaws:aws-lambda-java-log4j2:1.2.0',
+          'org.apache.logging.log4j:log4j-core:2.16.0',
+          'org.apache.logging.log4j:log4j-api:2.16.0',
+          'org.apache.logging.log4j:log4j-slf4j-impl:2.16.0',
+          'com.amazonaws:aws-lambda-java-log4j2:1.3.0',
   )
 }
 

samples/struts2/pet-store/pom.xml

@@ -29,7 +29,7 @@
         <struts2.version>2.5.26</struts2.version>
         <jackson.version>2.12.4</jackson.version>
         <junit.version>4.13.2</junit.version>
-        <log4j.version>2.15.0</log4j.version>
+        <log4j.version>2.16.0</log4j.version>
     </properties>
 
     <dependencies>
@@ -121,7 +121,7 @@
         <dependency>
             <groupId>com.amazonaws</groupId>
             <artifactId>aws-lambda-java-log4j2</artifactId>
-            <version>1.2.0</version>
+            <version>1.3.0</version>
         </dependency>
 
         <dependency>