Skip to content

Conversation

@agocs
Copy link
Contributor

@agocs agocs commented Dec 10, 2021

What does this PR do?

This bumps the versions of log4j-api and log4j-core that were imported for testing. The old versions of log4j were found to be susceptible to a remote code execution attack. See the following resources for more info:

datadog-lambda-java only uses log4j in testing, and the log4j dependency does not make it into the published library. Regardless, we are going to cut a new version to be safe.

Motivation

Testing Guidelines

Additional Notes

Types of changes

  • Bug fix
  • New feature
  • Breaking change
  • Misc (docs, refactoring, dependency upgrade, etc.)

Checklist

  • This PR's description is comprehensive
  • This PR contains breaking changes that are documented in the description
  • This PR introduces new APIs or parameters that are documented and unlikely to change in the foreseeable future
  • This PR impacts documentation, and it has been updated (or a ticket has been logged)
  • This PR's changes are covered by the automated tests
  • This PR collects user input/sensitive content into Datadog

@agocs agocs requested a review from a team as a code owner December 10, 2021 18:06
@agocs agocs merged commit 1b9ace3 into main Dec 10, 2021
@agocs agocs deleted the chris.agocs/update_log4j_version branch December 10, 2021 18:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants