TIKA-4348 -- downgrade log4j2 (#2043)

(cherry picked from commit 932edba)
apache · Nov 13, 2024 · 6685af3 · 6685af3
1 parent 8712267
commit 6685af3
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/tika-parent/pom.xml b/tika-parent/pom.xml
@@ -370,7 +370,7 @@
     <junit5.version>5.11.3</junit5.version>
     <junrar.version>7.5.5</junrar.version>
     <libpst.version>0.9.3</libpst.version>
-    <log4j2.version>2.24.1</log4j2.version>
+    <log4j2.version>2.24.0</log4j2.version>
     <lombok.version>1.18.20</lombok.version>
     <!-- lucene >= 9.x requires Java 11 -->
     <lucene.version>8.11.4</lucene.version>
@@ -1246,7 +1246,14 @@
               <rules>
                 <bannedDependencies>
                   <excludes>
+                    <!-- log4shell -->
                     <exclude>org.apache.logging.log4j:log4j-core:(,2.17.1)</exclude>
+                    <!--
+                          https://github.com/apache/logging-log4j2/issues/3143
+                          https://github.com/apache/logging-log4j2/issues/3196
+                      -->
+                    <exclude>org.apache.logging.log4j:log4j-core:[2.24.1]</exclude>
+                    <exclude>org.apache.logging.log4j:log4j-api:[2.24.1]</exclude>
                   </excludes>
                 </bannedDependencies>
               </rules>