From 8392075168622a6c34e2b054bba1c502e65cfe9e Mon Sep 17 00:00:00 2001
From: Sergey Matvienko <smatvienko@thingsboard.io>
Date: Mon, 13 Dec 2021 09:08:19 +0200
Subject: [PATCH 1/2] log4j-api and log4j-to-slf4j upgrade to 2.15 on
 dependency management

---
 pom.xml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pom.xml b/pom.xml
index ab92c575fd..33b531579a 100755
--- a/pom.xml
+++ b/pom.xml
@@ -47,6 +47,7 @@
         <jedis.version>3.3.0</jedis.version>
         <jjwt.version>0.7.0</jjwt.version>
         <slf4j.version>1.7.32</slf4j.version>
+        <log4j.version>2.15.0</log4j.version>
         <logback.version>1.2.6</logback.version>
         <rat.version>0.10</rat.version>
         <cassandra.version>4.10.0</cassandra.version>
@@ -1492,6 +1493,16 @@
                 <artifactId>jul-to-slf4j</artifactId>
                 <version>${slf4j.version}</version>
             </dependency>
+            <dependency>
+                <groupId>org.apache.logging.log4j</groupId>
+                <artifactId>log4j-api</artifactId>
+                <version>${log4j.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.logging.log4j</groupId>
+                <artifactId>log4j-to-slf4j</artifactId>
+                <version>${log4j.version}</version>
+            </dependency>
             <dependency>
                 <groupId>ch.qos.logback</groupId>
                 <artifactId>logback-core</artifactId>

From 2b06d15f3f066f63eabbacfc30c487af4a508ebd Mon Sep 17 00:00:00 2001
From: Sergey Matvienko <smatvienko@thingsboard.io>
Date: Mon, 13 Dec 2021 09:34:47 +0200
Subject: [PATCH 2/2] log4j-core defined to 2.15 on dependency management, but
 not used at this moment, just to be sure that no vulnerability brought by
 third-party. see https://github.com/advisories/GHSA-jfh8-c2jp-5v3q

---
 pom.xml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pom.xml b/pom.xml
index 33b531579a..705a7f5602 100755
--- a/pom.xml
+++ b/pom.xml
@@ -1498,6 +1498,11 @@
                 <artifactId>log4j-api</artifactId>
                 <version>${log4j.version}</version>
             </dependency>
+            <dependency>
+                <groupId>org.apache.logging.log4j</groupId>
+                <artifactId>log4j-core</artifactId>
+                <version>${log4j.version}</version>
+            </dependency>
             <dependency>
                 <groupId>org.apache.logging.log4j</groupId>
                 <artifactId>log4j-to-slf4j</artifactId>