Spring-boot-starter-log4j2 please support the latest version of log4j-2.15 0-rc1

[andotorg]

Spring-boot-starter-log4j2 please support the latest version of log4j-2.15 0-rc1

Log4j-2.15 0-rc1 security vulnerability latest fixed version

[yochi2333]

Now, Log4j-2.15 0-rc2 is the latest fixed version.

[ZeroZeroLi]

wait online

[scottfrederick]

Spring Boot will pick up the next Log4J release as part of the semi-automated dependency upgrade process. In the meantime, you can configure your build to use a version of your choice by setting the log4j2.version property in your build file as shown in the documentation.

[andotorg]

waiting for Spring Boot will pick up the next Log4J release as part of the semi-automated dependency upgrade process；
use log4j.version rebuild springboot project？ im so sorry，It's too difficult for me to build a spring boot project。

[andotorg]

Will spring officials consider rebuilding a version？

[snicoll]

@andotorg We will upgrade to this newer version of log4j but this won't happen in a maintenance release so if you want to use this version now, overriding it in your application as described in the documentation is what you should be doing.

It's too difficult for me to build a spring boot project。

If we did the upgrade, you'd have to rebuild your application anyway.

[andotorg]

I see, Thank you

[andotorg]

log4j2 2.15.0 official version published

[nessex]

To add some context, this is in response to the following RCE vulnerability:

https://www.lunasec.io/docs/blog/log4j-zero-day/

[snicoll]

@nessex thanks. We are aware of the CVE and the answers above still apply, there are a number of mitigations available in the link you've provided and upgrading your app is one of them. There's no need to wait for a Spring Boot release to do that.