关于 spring-boot-starter-log4j 启动器依赖如何修复 log4j 漏洞以及相关问题解决

springboot 项目一般使用 log4j 是直接引入 spring-boot-starter-log4j 启动器依赖，但是官方提供最新的 spring-boot-starter-log4j 版本是 2016年 的，存在 log4j 远程代码执行漏洞风险。

在此我将演示如何修复启动器依赖的方法。

 		
            org.springframework.boot
            spring-boot-starter-log4j
            1.3.8.RELEASE
            
                
                    org.apache.logging.log4j
                    log4j-core
                
                
                    org.apache.logging.log4j
                    log4j-api
                
                
                    org.apache.logging.log4j
                    log4j-slf4j-impl
                
                
                
                    org.slf4j
                    slf4j-log4j12
                
            
        

        
            org.apache.logging.log4j
            log4j-api
            2.17.1
        
        
            org.apache.logging.log4j
            log4j-core
            2.17.1
        
        
            org.apache.logging.log4j
            log4j-slf4j-impl
            2.17.1
        

SLF4J: Class path contains multiple SLF4J bindings.
SLF4J: Found binding in [jar:file:/E:/apache-maven-3.5.2/maven_repository/ch/qos/logback/logback-classic/1.2.3/logback-classic-1.2.3.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: Found binding in [jar:file:/E:/apache-maven-3.5.2/maven_repository/org/slf4j/slf4j-log4j12/1.7.30/slf4j-log4j12-1.7.30.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: Found binding in [jar:file:/E:/apache-maven-3.5.2/maven_repository/org/apache/logging/log4j/log4j-slf4j-impl/2.17.1/log4j-slf4j-impl-2.17.1.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation.
SLF4J: Actual binding is of type [ch.qos.logback.classic.util.ContextSelectorStaticBinder]

问题形成原因：依赖冲突

解决办法：查看依赖关系图，找出发生冲突的地方，排除即可

关系图如下：

       
            org.springframework.boot
            spring-boot-starter
            
                
                
                    org.springframework.boot
                    spring-boot-starter-logging
                
            
        

问题解决