Update log4j because of the CVE-2021-44228 security flaw

7 files changed, 34 insertions, 14 deletions

diff --git a/daemon/pom.xml b/daemon/pom.xml
index 7c26855..5733063 100644
--- a/daemon/pom.xml
+++ b/daemon/pom.xml
@@ -64,6 +64,18 @@
 			<version>${project.version}</version>
 			<scope>compile</scope>
 		</dependency>
+		<dependency>
+			<groupId>org.apache.logging.log4j</groupId>
+			<artifactId>log4j-api</artifactId>
+			<version>[2.0,3.0)</version>
+			<scope>compile</scope>
+		</dependency>
+		<dependency>
+			<groupId>org.apache.logging.log4j</groupId>
+			<artifactId>log4j-core</artifactId>
+			<version>[2.0,3.0)</version>
+			<scope>compile</scope>
+		</dependency>
 	</dependencies>
 
 
diff --git a/daemon/src/main/java/org/openslx/taskmanager/App.java b/daemon/src/main/java/org/openslx/taskmanager/App.java
index 6580550..cf63448 100644
--- a/daemon/src/main/java/org/openslx/taskmanager/App.java
+++ b/daemon/src/main/java/org/openslx/taskmanager/App.java
@@ -4,8 +4,10 @@ import java.io.IOException;
 import java.util.ArrayList;
 import java.util.List;
 
-import org.apache.log4j.BasicConfigurator;
-import org.apache.log4j.Logger;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.apache.logging.log4j.core.config.Configurator;
+import org.apache.logging.log4j.core.config.DefaultConfiguration;
 import org.openslx.taskmanager.api.Environment;
 import org.openslx.taskmanager.main.Taskmanager;
 import org.openslx.taskmanager.network.NetworkHandlerTcp;
@@ -19,11 +21,12 @@ import org.openslx.taskmanager.network.RequestParser;
 public class App
 {
 	
-	private static final Logger log = Logger.getLogger( App.class );
+	private static final Logger log = LogManager.getLogger( App.class );
 
 	public static void main( String[] args ) throws InterruptedException, IOException
 	{
-		BasicConfigurator.configure();
+		Configurator.initialize( new DefaultConfiguration() );
+
 		if (Global.PORT_UDP == -1 && Global.PORT_TCP == -1) {
 			log.fatal( "Neither UDP nor TCP configured" );
 			System.exit( 1 );
diff --git a/daemon/src/main/java/org/openslx/taskmanager/Global.java b/daemon/src/main/java/org/openslx/taskmanager/Global.java
index 5be8196..cdba3f8 100644
--- a/daemon/src/main/java/org/openslx/taskmanager/Global.java
+++ b/daemon/src/main/java/org/openslx/taskmanager/Global.java
@@ -11,13 +11,14 @@ import java.nio.file.Paths;
 import java.nio.file.attribute.PosixFilePermission;
 import java.util.Properties;
 
-import org.apache.log4j.Logger;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
 import org.openslx.taskmanager.util.Util;
 
 public class Global
 {
 
-	private static final Logger log = Logger.getLogger( Global.class );
+	private static final Logger log = LogManager.getLogger( Global.class );
 
 	public static final String TASK_PACKAGE_NAME = "org.openslx.taskmanager.tasks";
 
diff --git a/daemon/src/main/java/org/openslx/taskmanager/main/Taskmanager.java b/daemon/src/main/java/org/openslx/taskmanager/main/Taskmanager.java
index 74fc1b7..77d3405 100644
--- a/daemon/src/main/java/org/openslx/taskmanager/main/Taskmanager.java
+++ b/daemon/src/main/java/org/openslx/taskmanager/main/Taskmanager.java
@@ -11,7 +11,8 @@ import java.util.concurrent.ThreadPoolExecutor;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicInteger;
 
-import org.apache.log4j.Logger;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
 import org.openslx.taskmanager.Global;
 import org.openslx.taskmanager.api.AbstractTask;
 import org.openslx.taskmanager.api.CancellableTask;
@@ -26,7 +27,7 @@ import com.google.gson.JsonSyntaxException;
 public class Taskmanager implements FinishCallback, Runnable
 {
 
-	private static final Logger log = Logger.getLogger( Taskmanager.class );
+	private static final Logger log = LogManager.getLogger( Taskmanager.class );
 
 	private final ThreadPoolExecutor threadPool = new ThreadPoolExecutor( 8, 32, 1, TimeUnit.MINUTES,
 			new ArrayBlockingQueue<Runnable>( 4 ), new ThreadFactory() {
diff --git a/daemon/src/main/java/org/openslx/taskmanager/network/NetworkHandlerTcp.java b/daemon/src/main/java/org/openslx/taskmanager/network/NetworkHandlerTcp.java
index 4b69e55..6492f2e 100644
--- a/daemon/src/main/java/org/openslx/taskmanager/network/NetworkHandlerTcp.java
+++ b/daemon/src/main/java/org/openslx/taskmanager/network/NetworkHandlerTcp.java
@@ -14,7 +14,8 @@ import java.util.concurrent.ThreadPoolExecutor;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicInteger;
 
-import org.apache.log4j.Logger;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
 import org.openslx.taskmanager.Global;
 
 /**
@@ -24,7 +25,7 @@ import org.openslx.taskmanager.Global;
 public class NetworkHandlerTcp extends NetworkHandlerBase
 {
 
-	private static final Logger log = Logger.getLogger( NetworkHandlerTcp.class );
+	private static final Logger log = LogManager.getLogger( NetworkHandlerTcp.class );
 
 	/**
 	 * UDP socket for sending and receiving.
diff --git a/daemon/src/main/java/org/openslx/taskmanager/network/NetworkHandlerUdp.java b/daemon/src/main/java/org/openslx/taskmanager/network/NetworkHandlerUdp.java
index 7a25ed1..767e6a4 100644
--- a/daemon/src/main/java/org/openslx/taskmanager/network/NetworkHandlerUdp.java
+++ b/daemon/src/main/java/org/openslx/taskmanager/network/NetworkHandlerUdp.java
@@ -10,7 +10,8 @@ import java.nio.charset.StandardCharsets;
 import java.util.concurrent.BlockingQueue;
 import java.util.concurrent.LinkedBlockingQueue;
 
-import org.apache.log4j.Logger;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
 import org.openslx.taskmanager.Global;
 
 /**
@@ -20,7 +21,7 @@ import org.openslx.taskmanager.Global;
 public class NetworkHandlerUdp extends NetworkHandlerBase
 {
 
-	private static final Logger log = Logger.getLogger( NetworkHandlerUdp.class );
+	private static final Logger log = LogManager.getLogger( NetworkHandlerUdp.class );
 
 	private Thread sendThread = null;
 	/**
diff --git a/daemon/src/main/java/org/openslx/taskmanager/network/RequestParser.java b/daemon/src/main/java/org/openslx/taskmanager/network/RequestParser.java
index 55a44a5..09b94ce 100644
--- a/daemon/src/main/java/org/openslx/taskmanager/network/RequestParser.java
+++ b/daemon/src/main/java/org/openslx/taskmanager/network/RequestParser.java
@@ -3,7 +3,8 @@ package org.openslx.taskmanager.network;
 import java.nio.charset.StandardCharsets;
 import java.util.zip.Deflater;
 
-import org.apache.log4j.Logger;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
 import org.openslx.taskmanager.api.BoundedLog;
 import org.openslx.taskmanager.api.TaskStatus;
 import org.openslx.taskmanager.main.Taskmanager;
@@ -14,7 +15,7 @@ import com.google.gson.GsonBuilder;
 
 public class RequestParser
 {
-	private static final Logger log = Logger.getLogger( RequestParser.class );
+	private static final Logger log = LogManager.getLogger( RequestParser.class );
 
 	/**
 	 * Our very own gson instance (for serializing replies)