Exclude log4j SMTP Appender from cli jars
must be loaded through a dedicated class loader
-->
<exclude>co/elastic/apm/attach/bouncycastle/BouncyCastleVerifier.class</exclude>
+ <!--
+ Eliminating exposure to the log4j2 vulnerability related to the SMTP appender -
+ https://nvd.nist.gov/vuln/detail/CVE-2020-9488#vulnCurrentDescriptionTitle
+ -->
+ <exclude>org/apache/logging/log4j/core/appender/SmtpAppender.class</exclude>
</excludes>
</filter>
</filters>
must be loaded through a dedicated class loader
-->
<exclude>co/elastic/apm/attach/bouncycastle/BouncyCastleVerifier.class</exclude>
- </excludes>
- </filter>
- <filter>
- <artifact>org.apache.logging.log4j:log4j-core</artifact>
<!--
Eliminating exposure to the log4j2 vulnerability related to the SMTP appender -
https://nvd.nist.gov/vuln/detail/CVE-2020-9488#vulnCurrentDescriptionTitle
-->
- <excludes>
<exclude>org/apache/logging/log4j/core/appender/SmtpAppender.class</exclude>
</excludes>
</filter>
