[AVRO-3304] avro-tools Update log4j dependency for critical vulnerability - ASF JIRA

Voters

Watch issue

Watchers

Create sub-task

Link

Clone

Update Comment Author

Replace String in Comment

Update Comment Visibility

Delete Comments

XML

Word

Printable

JSON

Details

Type: Task
Status: Resolved
Priority: Major
Resolution: Fixed
Affects Version/s: 1.11.0
Fix Version/s: 1.11.1, 1.12.0
Component/s: tools
Labels:
- pull-request-available

Description

Our company security is having a fit because Nessus scans are triggering on the bundled log4j in the avro-tools.jar. Please update the log4j dependencies to the latest versions to remove the critical vulnerability present in the currently bundled log4j.