[TEZ-4403] Upgrade SLF4J version to 1.7.36

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.9.3, 0.10.2
• Target Version/s: 0.10.2
• Assignee: Syed Shameerur Rahman
• Reporter: Syed Shameerur Rahman
• Created: 05/Apr/22 09:25
• Updated: 30/Apr/22 08:25
• Resolved: 30/Apr/22 08:22

Description

Currently we are on slf4j 1.7.30 https://github.com/apache/tez/blob/master/pom.xml#L65. As per https://mvnrepository.com/artifact/org.slf4j/slf4j-log4j12/1.7.30 , There are four CVE's against this version.
1. CVE-2022-23305
2. CVE-2022-23302
3. CVE-2021-4104
4. CVE-2019-17571

Upgrading to 1.7.36 https://mvnrepository.com/artifact/org.slf4j/slf4j-log4j12/1.7.36 should solve the security concerns.

Issue Links

• links to: GitHub Pull Request #198