Override logback version to 1.13.14

This commit overrides the logback version in order to fix CVE-2023-6378. See spring-cloud/spring-cloud-dataflow#5593
onobc · Dec 7, 2023 · 1d992f9 · 1d992f9
1 parent 0582721
commit 1d992f9
Showing 1 changed file with 17 additions and 0 deletions.
diff --git a/pom.xml b/pom.xml
@@ -61,6 +61,7 @@
 		<spring-boot.version>2.7.18</spring-boot.version>
 		<maven.compiler.source>${java.version}</maven.compiler.source>
 		<maven.compiler.target>${java.version}</maven.compiler.target>
+		<logback.version>1.3.14</logback.version>
 	</properties>
 
 	<modules>
@@ -102,6 +103,22 @@
 				<type>pom</type>
 				<scope>import</scope>
 			</dependency>
+			<!-- Override Logback provided by Spring Boot -->
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-core</artifactId>
+				<version>${logback.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-classic</artifactId>
+				<version>${logback.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>ch.qos.logback</groupId>
+				<artifactId>logback-access</artifactId>
+				<version>${logback.version}</version>
+			</dependency>
 			<dependency>
 				<groupId>org.springframework.boot</groupId>
 				<artifactId>spring-boot-dependencies</artifactId>