[
https://issues.apache.org/jira/browse/MJAVADOC-726?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17767510#comment-17767510
]
Elliotte Rusty Harold edited comment on MJAVADOC-726 at 9/21/23 11:27 AM:
--------------------------------------------------------------------------
It should be possible to put log4j 1.2.17 somewhere higher up in the dependency
tree oe just use dependency management, and that will take precedence over
1.2.12. This should fix any project that depends on maven-javadoc-plugin. If
one is simply running maven-javadioc-plugin, we'd still need a release.
was (Author: elharo):
It should be possible to put log4j 1.2.17 somewhere higher up in the dependency
tree oe just use dependency management, and that will take precedence over
1.2.12.
> Maven Java Doc Plugin downloads Log4j-1.2.12 dependency transitively
> --------------------------------------------------------------------
>
> Key: MJAVADOC-726
> URL: https://issues.apache.org/jira/browse/MJAVADOC-726
> Project: Maven Javadoc Plugin
> Issue Type: Bug
> Components: jar, javadoc
> Affects Versions: 3.4.0
> Environment: Windows 10
> Reporter: Yogesh Desai
> Priority: Major
> Labels: Vulnerability, vulnerability
> Fix For: wontfix-candidate, waiting-for-feedback
>
> Attachments: log4j-1.2.12.png
>
>
> I have observed that Maven Javadoc Plug-in v3.4.0 downloads Log4j-1.2.12
> dependency transitively in local maven repository i.e. .m2 folder upon
> running maven update in eclipse IDE or from command line. Since Log4j-1.X is
> strictly prohibited for use in many organisations, we had no other option
> that not using the plugin. Please plan to fix this issue and get rid of the
> log4j-1.X dependency.
> *Steps to Reproduce-*
> 1. Add maven javadoc plugin v3.4.0 in your project POM file
> <plugin>
> <groupId>org.apache.maven.plugins</groupId>
> <artifactId>maven-javadoc-plugin</artifactId>
> <version>3.4.0</version>
> <configuration>
> <encoding>UTF-8</encoding>
> <additionalparam>-Xdoclint:none</additionalparam>
> </configuration>
> <executions>
> <execution>
> <id>attach-javadocs</id>
> <goals>
> <goal>jar</goal>
> </goals>
> </execution>
> </executions>
> </plugin>
> 2. Observe your local maven repository ie. .m2 folder and see if there are
> any log4j-1.2.12 artifacts are present in log4j folder of it. If artifacts
> are present already, delete them for now.
> 3. Run maven update command for your project (additionally run maven install
> command as needed)
> 4. Observe your local maven repository ie. .m2 folder and see if there are
> any log4j-1.2.12 artifacts are generated with latest timestamp inside log4j
> folder.
> Attached is the screenshot showing, maven javadoc plugin v3.4.0 used in
> POM.xml and log4j-1.2.12 dependency getting downloaded in local maven
> repository i.e. .m2 folder.
> Let me know if any other information is required. Thanks!
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
