From 6ab03e88a35d9fc90c0d9f6ec7d9031f13a39d13 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois-Xavier=20Thomas?= <fx.thomas@gmail.com>
Date: Fri, 1 May 2020 13:43:34 +0200
Subject: [PATCH] Temporarily update log4j dependency to fix CVE-2020-9488

---
 pom.xml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/pom.xml b/pom.xml
index e07e9814..9ab265b9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -90,6 +90,18 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
+            <dependency>
+                <!-- Spring Boot 2.2.6 doesn't update log4j yet, fixes CVE -->
+                <groupId>org.apache.logging.log4j</groupId>
+                <artifactId>log4j-api</artifactId>
+                <version>2.13.2</version>
+            </dependency>
+            <dependency>
+                <!-- Spring Boot 2.2.6 doesn't update log4j yet, fixes CVE -->
+                <groupId>org.apache.logging.log4j</groupId>
+                <artifactId>log4j-to-slf4j</artifactId>
+                <version>2.13.2</version>
+            </dependency>
             <dependency>
                 <groupId>org.liquibase</groupId>
                 <artifactId>liquibase-core</artifactId>