From 1a77d7171f23b2ec3d987d6d8b1064eb41d26b4c Mon Sep 17 00:00:00 2001
From: Tim Allison <tallison@apache.org>
Date: Wed, 13 Nov 2024 10:35:14 -0500
Subject: [PATCH] TIKA-4348 -- downgrade log4j2 (#2043)

(cherry picked from commit 932edbaff3b69034e4840033dfa9019dddbb10fc)
---
 tika-parent/pom.xml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/tika-parent/pom.xml b/tika-parent/pom.xml
index eeb909cc0c..778193fa4a 100644
--- a/tika-parent/pom.xml
+++ b/tika-parent/pom.xml
@@ -394,7 +394,8 @@
     <jwarc.version>0.30.0</jwarc.version>
     <kafka.version>3.9.0</kafka.version>
     <libpst.version>0.9.3</libpst.version>
-    <log4j2.version>2.24.1</log4j2.version>
+    <log4j2.version>2.24.0</log4j2.version>
+    <!-- can't update to 10, needs jdk21 -->
     <lucene.version>9.12.0</lucene.version>
     <maven.plugin.annotations.version>3.15.1</maven.plugin.annotations.version>
     <mchange.version>0.3.1</mchange.version>
@@ -1251,7 +1252,14 @@
               <rules>
                 <bannedDependencies>
                   <excludes>
+                    <!-- log4shell -->
                     <exclude>org.apache.logging.log4j:log4j-core:(,2.17.1)</exclude>
+                    <!--
+                        https://github.com/apache/logging-log4j2/issues/3143
+                        https://github.com/apache/logging-log4j2/issues/3196
+                    -->
+                    <exclude>org.apache.logging.log4j:log4j-core:[2.24.1]</exclude>
+                    <exclude>org.apache.logging.log4j:log4j-api:[2.24.1]</exclude>
                   </excludes>
                 </bannedDependencies>
               </rules>