ignore jdom2 cve warnings until there is a fix available
<artifactId>log4j</artifactId>
<version>1.2.17</version>
</exclude>
+ <exclude>
+ <groupId>org.jdom</groupId>
+ <artifactId>jdom2</artifactId>
+ <version>2.0.6</version>
+ </exclude>
</excludeCoordinates>
</configuration>
<executions>
