Apache Log4j任意代碼執行漏洞修復 spring-boot-starter-log4j2

1、概述

項目使用log4j 1.2.17結合spring-boot-starter-log4j2進行日志記錄，針對log4j漏洞進行修復

2、修復

只需要添加一下依賴即可

<!--升級log4j到log4j2.15版本-->
 <!--刪除log4j1x版本
  <dependency>
      <groupId>log4j</groupId>
      <artifactId>log4j</artifactId>
      <version>1.2.17</version>
  </dependency>
  -->
<!-- 排除log4j-->
 <dependency>
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-log4j2</artifactId>
     <exclusions>
         <exclusion>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-api</artifactId>
         </exclusion>
         <exclusion>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-core</artifactId>
         </exclusion>
         <exclusion>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-slf4j-impl</artifactId>
         </exclusion>
     </exclusions>
 </dependency>
 <!-- log4j2核心包 -->
 <dependency>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j-core</artifactId>
     <version>2.15.0</version>
 </dependency>

 <!-- log4j2門面包 -->
 <dependency>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j-api</artifactId>
     <version>2.15.0</version>
 </dependency>

 <!-- 該包是 log4j 升級到 log4j2的必須包 使用該包 不需要修改以前的 Logger.getLogger()這種獲取對象的方式 -->
 <dependency>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j-1.2-api</artifactId>
     <version>2.15.0</version>
 </dependency>
 <!-- 該包是slf4j 升級到 log4j2的必須包 使用該包 其他依賴jar中依賴slf4j 不會報錯 -->
 <dependency>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j-slf4j-impl</artifactId>
     <version>2.15.0</version>
 </dependency>