Update pom.xml

core/pom.xml

@@ -3,14 +3,11 @@
          xmlns="http://maven.apache.org/POM/4.0.0"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   <modelVersion>4.0.0</modelVersion>
-
   <groupId>pentaho-kettle</groupId>
   <artifactId>kettle-core</artifactId>
   <version>10.2.0.0-SNAPSHOT</version>
   <packaging>jar</packaging>
-
   <name>PDI Core</name>
-
   <parent>
     <groupId>org.pentaho.di</groupId>
     <artifactId>pdi</artifactId>

pom.xml

@@ -18,7 +18,6 @@
     <artifactId>pentaho-ce-jar-parent-pom</artifactId>
     <version>10.2.0.0-SNAPSHOT</version>
   </parent>
-
   <scm>
     <developerConnection>scm:git:[email protected]:pentaho/pentaho-kettle.git</developerConnection>
     <tag>HEAD</tag>
@@ -74,6 +73,12 @@
 
   <dependencyManagement>
     <dependencies>
+      <dependency>
+         <groupId>org.apache.logging.log4j</groupId>
+         <artifactId>log4j-core</artifactId>
+         <version>2.13.0</version> <!-- [vulnerable 2.14.1] latest 2.22.0 -->
+      </dependency>
+
       <dependency>
         <groupId>org.pentaho</groupId>
         <artifactId>commons-xul-core</artifactId>