[Snyk] Security upgrade org.apache.logging.log4j:log4j-core from 2.14.1 to 2.16.0

[samsnyk]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• log4shell-goof/log4shell-client/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Remote Code Execution (RCE) SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2320014	919	org.apache.logging.log4j:log4j-core: 2.14.1 -> 2.16.0 No Path Found Mature

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Remote Code Execution (RCE)

[samsnyk]

This upgrade from version 2.14.1 to 2.16.0 addresses the critical Log4Shell vulnerability (CVE-2021-44228) and introduces significant breaking changes as part of the security hardening.

Key Breaking Changes:

• JNDI Disabled by Default: In version 2.15.0, JNDI lookups were disabled by default to mitigate the primary attack vector. In version 2.16.0, JNDI is completely disabled and the property to re-enable it (log4j2.enableJndi) is removed. Any application relying on JNDI lookups in its logging configuration will break.
• Message Lookups Removed: The ability to resolve lookups within the log message text (e.g., ${ctx:user} in the message itself) was disabled by default in 2.15.0 and completely removed in 2.16.0. Applications that relied on this feature for dynamic message formatting will no longer function as expected.

Recommendation: This is a critical security upgrade. Developers must verify that the application does not use JNDI lookups or message lookups in its logging configuration. The removal of these features is a deliberate security measure and alternative approaches should be used if this functionality was previously relied upon.

Source: Apache Log4j Release Notes

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.