diff --git a/build.gradle b/build.gradle
index 0a2176ee7d1..c32fcbcf109 100644
--- a/build.gradle
+++ b/build.gradle
@@ -55,6 +55,7 @@ configure(allprojects) { project ->
 	ext.jrubyVersion         = "1.7.25"  // JRuby 9000 only supported through JSR-223 (StandardScriptFactory)
 	ext.jtaVersion           = "1.2"
 	ext.junitVersion         = "4.12"
+	ext.log4jVersion         = "1.2.17"
 	ext.nettyVersion         = "4.0.37.Final"
 	ext.okhttpVersion        = "2.7.5"
 	ext.openjpaVersion       = "2.4.1"
@@ -67,7 +68,7 @@ configure(allprojects) { project ->
 	ext.testngVersion        = "6.9.10"
 	ext.tiles2Version        = "2.2.2"
 	ext.tiles3Version        = "3.0.5"
-	ext.tomcatVersion        = "8.0.35"
+	ext.tomcatVersion        = "8.0.36"
 	ext.tyrusVersion         = "1.3.5"  // constrained by WebLogic 12.1.3 support
 	ext.undertowVersion      = "1.3.23.Final"
 	ext.xmlunitVersion       = "1.6"
@@ -283,7 +284,7 @@ project("spring-core") {
 	// both into the spring-core jar. cglib 3.2 itself depends on asm 5.0 and is therefore
 	// further transformed by the JarJar task to depend on org.springframework.asm; this
 	// avoids including two different copies of asm unnecessarily.
-	def cglibVersion = "3.2.2"
+	def cglibVersion = "3.2.4"
 	def objenesisVersion = "2.2"
 
 	configurations {
@@ -345,7 +346,7 @@ project("spring-core") {
 		optional("commons-codec:commons-codec:1.10")
 		optional("org.aspectj:aspectjweaver:${aspectjVersion}")
 		optional("net.sf.jopt-simple:jopt-simple:4.9")
-		optional("log4j:log4j:1.2.17")
+		optional("log4j:log4j:${log4jVersion}")
 		testCompile("org.apache.tomcat.embed:tomcat-embed-core:${tomcatVersion}")
 		testCompile("xmlunit:xmlunit:${xmlunitVersion}")
 		testCompile("com.fasterxml.woodstox:woodstox-core:5.0.2") {
@@ -376,7 +377,7 @@ project("spring-beans") {
 		optional("javax.inject:javax.inject:1")
 		optional("javax.el:javax.el-api:2.2.5")
 		optional("org.yaml:snakeyaml:${snakeyamlVersion}")
-		testCompile("log4j:log4j:1.2.17")
+		testCompile("log4j:log4j:${log4jVersion}")
 		testCompile("org.apache.tomcat.embed:tomcat-embed-core:${tomcatVersion}")
 	}
 }
@@ -523,7 +524,7 @@ project("spring-messaging") {
 		testCompile("org.apache.tomcat.embed:tomcat-embed-logging-juli:${tomcatVersion}")
 		testCompile("io.netty:netty-all:${nettyVersion}")
 		testCompile("commons-dbcp:commons-dbcp:1.4")
-		testCompile("log4j:log4j:1.2.17")
+		testCompile("log4j:log4j:${log4jVersion}")
 		testCompile("org.slf4j:slf4j-jcl:${slf4jVersion}")
 		testCompile("xmlunit:xmlunit:${xmlunitVersion}")
 	}
@@ -709,7 +710,7 @@ project("spring-web") {
 		optional("org.eclipse.jetty:jetty-server:${jettyVersion}") {
 			exclude group: "javax.servlet", module: "javax.servlet-api"
 		}
-		optional("log4j:log4j:1.2.17")
+		optional("log4j:log4j:${log4jVersion}")
 		optional("com.google.protobuf:protobuf-java:2.6.1")
 		optional("com.googlecode.protobuf-java-format:protobuf-java-format:1.2")
 		optional("javax.mail:javax.mail-api:${javamailVersion}")
@@ -973,7 +974,7 @@ project("spring-websocket") {
 		testCompile("org.apache.tomcat.embed:tomcat-embed-logging-juli:${tomcatVersion}")
 		testCompile("io.projectreactor:reactor-net:${reactorVersion}")
 		testCompile("io.netty:netty-all:${nettyVersion}")
-		testCompile("log4j:log4j:1.2.17")
+		testCompile("log4j:log4j:${log4jVersion}")
 		testCompile("org.slf4j:slf4j-jcl:${slf4jVersion}")
 	}
 }
@@ -1031,6 +1032,7 @@ project("spring-test") {
 		testCompile("org.slf4j:slf4j-jcl:${slf4jVersion}")
 		testCompile("org.apache.httpcomponents:httpclient:${httpclientVersion}")
 		testCompile("javax.cache:cache-api:1.0.0")
+		testRuntime("log4j:log4j:${log4jVersion}")
 		testRuntime("org.ehcache:ehcache:${ehcache3Version}")
 		testRuntime("org.terracotta:management-model:2.0.0")
 	}