Require log4j-2.16.0 (#749)

Signed-off-by: David Venable <[email protected]>
opensearch-project · Dec 15, 2021 · e3d5b67 · e3d5b67
1 parent 898a3ff
commit e3d5b67
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/build.gradle b/build.gradle
@@ -66,13 +66,13 @@ subprojects {
             }
             implementation('org.apache.logging.log4j:log4j-core') {
                 version {
-                    require '2.15.0'
+                    require '2.16.0'
                 }
-                because 'Log4j 2.15.0 fixes CVE-2021-44228'
+                because 'Log4j 2.16.0 fixes CVE-2021-44228 and CVE-2021-45046'
             }
             implementation('org.apache.logging.log4j:log4j-api') {
                 version {
-                    require '2.15.0'
+                    require '2.16.0'
                 }
                 because 'the build fails if the Log4j API is not update along with log4j-core'
             }