I created a dynamic web application in eclipse Version: Kepler Service Release 1 using menu. After that I converted it into a maven project using configure -> convert to maven project. Then I did maven->Add dependency and then searched for log4j.
After adding that on hovering over the tag for log4j it displays Missing artifact log4j:log4j:bundle:1.2.17. I can't update dependencies using maven. How to fix it? Please also explain the reason for the error.
Here is the generated xml after adding log4j.
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>Healthcare</groupId>
<artifactId>Healthcare</artifactId>
<version>0.0.1-HEALTHCARE</version>
<packaging>war</packaging>
<build>
<sourceDirectory>src</sourceDirectory>
<plugins>
<plugin>
<artifactId>maven-compiler-plugin</artifactId>
<version>3.1</version>
<configuration>
<source>1.6</source>
<target>1.6</target>
</configuration>
</plugin>
<plugin>
<artifactId>maven-war-plugin</artifactId>
<version>2.3</version>
<configuration>
<warSourceDirectory>WebContent</warSourceDirectory>
<failOnMissingWebXml>false</failOnMissingWebXml>
</configuration>
</plugin>
</plugins>
</build>
<dependencies>
<dependency>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
<version>1.2.17</version>
<type>bundle</type>
</dependency>
</dependencies>
</project>
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data.
Apache log4j 1.2. 17 is distributed under the Apache License, version 2.0. The link in the Mirrors column should display a list of available mirrors with a default selection based on your inferred location.
First why did you changed the default source folder location? The default is src/main/java
and for webapp src/main/webapp
. Apart from that a bundle for log4j does not exist on Maven Central just remove the <type>bundle</type>
from your dependency, cause in Maven Central only a jar is available.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With