How to fix Log4J Vulnerability in Gradle Project - spring

Question

I can see org.apache.logging.log4j:log4j-core:2.14.0 Library in Gradle dependency tree for my project.
We have not added log4j version from outside. This version is coming as part of transitive dependencies from other jars or spring-boot-starter.
How to override the log4j version in Gradle?

Answer 1

First, find out which log4j-related libraries you are really using, e.g. by
.\gradlew dependencies --configuration=testRuntimeClasspath | find "log4j"
Then override them with a current version like so (docs), placed after the dependencies block:
configurations.all {
resolutionStrategy {
force 'org.apache.logging.log4j:log4j-api:2.17.0'
force 'org.apache.logging.log4j:log4j-core:2.17.0'
force 'org.apache.logging.log4j:log4j-slf4j-impl:2.17.0'
force 'org.apache.logging.log4j:log4j-jul:2.17.0'
}
}
You might need to add more/fewer libraries to that block depending on the results of the check in the beginning.
Since you are using Spring Boot, you can also use a Spring-Boot-specific feature to set the Log4J version:
ext['log4j2.version'] = '2.17.0'

Answer 2

I'm on MacOS and using subprojects:
First I run: ./gradlew projects which will list my subprojects:
The output:
:projects
------------------------------------------------------------
Root project
------------------------------------------------------------
Root project 'test-backend'
+--- Project ':test-suite'
+--- Project ':test-suite-services'
\--- Project ':test-utils'
Using the output we can one by one check for dependencies:
./gradlew test-suite:dependencies | grep "log4j"
./gradlew test-suite-services:dependencies | grep "log4j"
./gradlew test-utils:dependencies | grep "log4j"

Answer 3

https://docs.gradle.org/current/userguide/resolution_rules.html constrains are preferred.
https://docs.gradle.org/current/userguide/rich_versions.html#rich-version-constraints
https://blog.gradle.org/log4j-vulnerability
dependencies {
constraints {
implementation('org.apache.logging.log4j:log4j-api') {
version {
strictly('[2.17, 3[')
prefer('2.17.0')
}
because('CVE-2021-44228, CVE-2021-45046, CVE-2021-45105: Log4j vulnerable to remote code execution and other critical security vulnerabilities')
}
implementation('org.apache.logging.log4j:log4j-core') {
version {
strictly('[2.17, 3[')
prefer('2.17.0')
}
because('CVE-2021-44228, CVE-2021-45046, CVE-2021-45105: Log4j vulnerable to remote code execution and other critical security vulnerabilities')
}
implementation('org.apache.logging.log4j:log4j-slf4j-impl') {
version {
strictly('[2.17, 3[')
prefer('2.17.0')
}
because('CVE-2021-44228, CVE-2021-45046, CVE-2021-45105: Log4j vulnerable to remote code execution and other critical security vulnerabilities')
}
implementation('org.apache.logging.log4j:log4j-web') {
version {
strictly('[2.17, 3[')
prefer('2.17.0')
}
because('CVE-2021-44228, CVE-2021-45046, CVE-2021-45105: Log4j vulnerable to remote code execution and other critical security vulnerabilities')
}
}
}