Log4j-7月-2.11.2期:部署时制作的日志4J-7月

Question

在处理log4j漏洞问题时，需要帮助。我在研究intellij。我已将依赖项更改为指向2.17.0。然而，log4j-jl-2.11.2jar正在生成。

rw-r-r-r.1 mdXXX mdpXXX 23998 2021年1月8日log4j-7月-2.11.2.jar

这个log4j-jul是从Maven的外部库中获取的。我从库中删除了这个依赖项。但正如上面提到的，它仍然创建了一个jar。任何指示都会有帮助。

添加Pom

<properties>
        <java.version>1.8</java.version>
        <spring.version>4.1.6.RELEASE</spring.version>
        <spring.data.version>1.8.0.RELEASE</spring.data.version>
      
   <spring.integration.version>4.1.2.RELEASE</spring.integration.version>
        <slf4j.version>1.6.1</slf4j.version>
        <junit.version>4.12</junit.version>
        <testng.version>6.8.21</testng.version>
        <dbunit.version>2.4.8</dbunit.version>
        <mockito.version>1.9.5</mockito.version>
        <spring.dbunit.version>1.2.0</spring.dbunit.version>
        <hsqldb.version>2.3.2</hsqldb.version>
        <h2.version>1.4.185</h2.version>
        <ojdbc6.version>11.2.0.2.0</ojdbc6.version>
        <wiremock.version>1.40</wiremock.version>
        <csv.version>1.1</csv.version>
        <dbcp.version>1.4</dbcp.version>
        <io.version>2.4</io.version>
        <velocity.version>1.7</velocity.version>
        <ucp.version>11.2.0.3</ucp.version>
        <joda.time.version>2.7</joda.time.version>
        <hibernate.entitymanager.version>4.3.9.Final</hibernate.entitymanager.version>
        <hibernate.jpa.version>1.0.0.Final</hibernate.jpa.version>
        <json.version>2.1-rev7</json.version>

        <surefire.plugin.version>2.18.1</surefire.plugin.version>
        <failsafe.plugin.version>2.18.1</failsafe.plugin.version>
        <compiler.plugin.version>3.3</compiler.plugin.version>
        <assembly.plugin.version>3.0.0</assembly.plugin.version>
        <release.plugin.version>2.3.2</release.plugin.version>
        <pmd.plugin.version>3.8</pmd.plugin.version>
        <checkstyle.plugin.version>2.13</checkstyle.plugin.version>
        <rulesets-directory>build</rulesets-directory>

        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    </properties>

    <dependencyManagement>
                    <!-- *********** -->
            <!-- Spring      -->
            <!-- *********** -->
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-framework-bom</artifactId>
                <version>${spring.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>

            <!-- Spring Data  -->

            <dependency>
                <groupId>org.springframework.data</groupId>
                <artifactId>spring-data-jpa</artifactId>
                <version>${spring.data.version}</version>
            </dependency>
            <!-- Spring Integration     -->
            <dependency>
                <groupId>org.springframework.integration</groupId>
                <artifactId>spring-integration-core</artifactId>
                <version>${spring.integration.version}</version>
            </dependency>
            <dependency>
                <groupId>org.springframework.integration</groupId>
                <artifactId>spring-integration-file</artifactId>
                <version>${spring.integration.version}</version>
            </dependency>
            <dependency>
                <groupId>org.springframework.integration</groupId>
                <artifactId>spring-integration-jdbc</artifactId>
                <version>${spring.integration.version}</version>
            </dependency>

            <!-- *********** -->
            <!-- Logging     -->
            <!-- *********** -->
            <dependency>
                <artifactId>slf4j-api</artifactId>
                <groupId>org.slf4j</groupId>
                <version>${slf4j.version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.logging.log4j</groupId>
                <artifactId>log4j-slf4j-impl</artifactId>
                <version>2.17.0</version>
            </dependency>
            <dependency>
                <groupId>org.apache.logging.log4j</groupId>
                <artifactId>log4j-core</artifactId>
                <version>2.17.0</version>
            </dependency>
            <dependency>
                <groupId>org.apache.logging.log4j</groupId>
                <artifactId>log4j-api</artifactId>
                <version>2.17.0</version>
            </dependency>

    </dependencies>
    </dependencyManagement>

Answer 1

您必须对log4j-jul具有传递依赖关系，并且由于您没有指定要在托管依赖项中使用的版本，所以Maven选择了2.11.2。

当然，指定Log4j 2.x项目的所有26个工件的版本可能很繁琐，这就是为什么您可以导入log4j-bom工件以更快地完成所有事情的原因：

<properties>
  <log4j2.version>2.17.0</log4j2.version>
</properties>
<dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>org.apache.logging.log4j</groupId>
      <artifactId>log4j-bom</artifactId>
      <version>${log4j2.version}</version>
      <type>pom</type>
      <scope>import</scope>
    </dependency>
  </dependencies>
</dependencyManagement>