proper way to upgrade CAS using cas-overlay-template

Pablo Vidaurri

unread,

Dec 13, 2021, 3:35:17 PM12/13/21

to CAS Community

We currently have 6.3.7 deployed. I see cas project v6.3.7.2 has the fix for the log4j vulnerability (using log4j-core v2.15.0). So what is the proper way to upgrade CAS template? Looking at the cas project i see gradle.properties has log4jVersion set to 2.15.0 . But looking at the cas-overlay project, gradle.properties still has cas.version=6.3.7.

Can I just update the cas-template project to use cas.version to 6.3.7.2?

Misagh

unread,

Dec 13, 2021, 11:07:32 PM12/13/21

to CAS Community

Yes you can.

-- Misagh

On Tue, Dec 14, 2021, 12:35 AM Pablo Vidaurri <psvid...@gmail.com> wrote:

We currently have 6.3.7 deployed. I see cas project v6.3.7.2 has the fix for the log4j vulnerability (using log4j-core v2.15.0). So what is the proper way to upgrade CAS template? Looking at the cas project i see gradle.properties has log4jVersion set to 2.15.0 . But looking at the cas-overlay project, gradle.properties still has cas.version=6.3.7.

Can I just update the cas-template project to use cas.version to 6.3.7.2?

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/2bacb815-d2b4-4cdc-bc84-f80b5a420f77n%40apereo.org.

Pablo Vidaurri

unread,

Dec 14, 2021, 7:45:12 PM12/14/21

to CAS Community, Misagh Moayyed

Looks like we should be using log4j v 2.16.0 as 2.15.0 will not be good enough.

https://logging.apache.org/log4j/2.x/security.html

Reply all

Reply to author

Forward