[Snyk] Security upgrade org.apache.logging.log4j:log4j-core from 2.15.0 to 2.16.0

[samsnyk]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• log4shell-goof/log4shell-server/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Remote Code Execution (RCE) SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2320014	919	org.apache.logging.log4j:log4j-core: 2.15.0 -> 2.16.0 No Path Found Mature

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Remote Code Execution (RCE)

[samsnyk]

This upgrade from log4j-core 2.15.0 to 2.16.0 was released to address security vulnerabilities (CVE-2021-45046) and introduces significant breaking changes as part of its security hardening.

Breaking Changes:

• JNDI Disabled by Default: JNDI functionality, which was restricted in 2.15.0, is now disabled by default. Applications that rely on JNDI for lookups in their logging configuration will fail unless the functionality is explicitly re-enabled.
• Message Lookups Removed: Support for message lookup patterns has been completely removed to prevent remote code execution vulnerabilities. Any code or configuration that uses this feature will no longer work.

Recommendation:

• If your application uses JNDI lookups within Log4j, you must set the log4j2.enableJndi system property to true to restore the previous behavior. However, be aware of the security implications.
• Review your codebase and logging configurations to ensure you are not using message lookup patterns, as they have been removed and will cause errors.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.