Apache Log4j任意代码执行漏洞修复 spring-boot-starter-log4j2

1、概述

项目使用log4j 1.2.17结合spring-boot-starter-log4j2进行日志记录，针对log4j漏洞进行修复

2、修复

只需要添加一下依赖即可

<!--升级log4j到log4j2.15版本-->
 <!--删除log4j1x版本
  <dependency>
      <groupId>log4j</groupId>
      <artifactId>log4j</artifactId>
      <version>1.2.17</version>
  </dependency>
  -->
<!-- 排除log4j-->
 <dependency>
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-log4j2</artifactId>
     <exclusions>
         <exclusion>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-api</artifactId>
         </exclusion>
         <exclusion>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-core</artifactId>
         </exclusion>
         <exclusion>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-slf4j-impl</artifactId>
         </exclusion>
     </exclusions>
 </dependency>
 <!-- log4j2核心包 -->
 <dependency>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j-core</artifactId>
     <version>2.15.0</version>
 </dependency>

 <!-- log4j2门面包 -->
 <dependency>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j-api</artifactId>
     <version>2.15.0</version>
 </dependency>

 <!-- 该包是 log4j 升级到 log4j2的必须包 使用该包 不需要修改以前的 Logger.getLogger()这种获取对象的方式 -->
 <dependency>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j-1.2-api</artifactId>
     <version>2.15.0</version>
 </dependency>
 <!-- 该包是slf4j 升级到 log4j2的必须包 使用该包 其他依赖jar中依赖slf4j 不会报错 -->
 <dependency>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j-slf4j-impl</artifactId>
     <version>2.15.0</version>
 </dependency>