[AVRO-3304] avro-tools Update log4j dependency for critical vulnerability

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.11.0
• Fix Version/s: 1.11.1, 1.12.0
• Component/s: tools
• Labels: pull-request-available
• Assignee: Ryan Skraba
• Reporter: Daniel Nash
• Created: 13/Jan/22 12:29
• Updated: 21/Jan/22 13:39
• Resolved: 19/Jan/22 11:37

Description

Our company security is having a fit because Nessus scans are triggering on the bundled log4j in the avro-tools.jar.  Please update the log4j dependencies to the latest versions to remove the critical vulnerability present in the currently bundled log4j.

Issue Links

• links to: GitHub Pull Request #1458
• links to: GitHub Pull Request #1464