[BAHIR-294] Update log4j2 version to 2.17.0

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Flink-1.0
• Fix Version/s: Flink-1.1.0
• Component/s: Flink Streaming Connectors
• Assignee: João Boto
• Reporter: haoqi
• Created: 13/Dec/21 06:37
• Updated: 01/Mar/22 15:12
• Resolved: 26/Dec/21 18:59

Description

2.0 <= Apache log4j2 <= 2.14.1 have a RCE zero day.

 

https://www.cyberkendra.com/2021/12/worst-log4j-rce-zeroday-dropped-on.html

 

https://www.lunasec.io/docs/blog/log4j-zero-day/

Issue Links

• links to: GitHub Pull Request #139
• links to: GitHub Pull Request #143