[BEAM-13434] Bump up Apache log4j2 to 2.16.0 due to the vulnerability

• Type: Improvement
• Status: Triage Needed
• Priority: P1
• Resolution: Fixed
• Affects Version/s: 2.34.0
• Fix Version/s: 2.35.0
• Component/s: sdk-java-core
• Assignee: Unassigned
• Reporter: Yu Ishikawa
• Created: 10/Dec/21 04:42
• Updated: 13/Apr/23 11:07
• Resolved: 10/Dec/21 15:42

Description

1. 1. Overview

2.0 <= Apache log4j2 <= 2.14.1 has vulnerability.

 

>  In most cases, developers may write error messages caused by user input into the log. Attackers can use this feature to construct special data request packets through this vulnerability, and ultimately trigger remote code execution.

 

[UPDATED]

The vulnerability is labeled to `CVE-2021-44228`.

• https://nvd.nist.gov/vuln/detail/CVE-2021-44228

 

1. 1. References

• https://www.cyberkendra.com/2021/12/worst-log4j-rce-zeroday-dropped-on.html
• https://www.spigotmc.org/threads/spigot-security-releases-%E2%80%94-1-8-8%E2%80%931-18.537204/

Issue Links

• links to: GitHub Pull Request #16191
• links to: GitHub Pull Request #16217
• links to: GitHub Pull Request #16218
• links to: GitHub Pull Request #16223
• links to: GitHub Pull Request #16224
• links to: GitHub Pull Request #16233
• links to: GitHub Pull Request #16237
• links to: GitHub Pull Request #16264
• links to: GitHub Pull Request #16265
• links to: GitHub Pull Request #16289
• links to: GitHub Pull Request #16296
• links to: GitHub Pull Request #16299
• links to: GitHub Pull Request #16302
• links to: GitHub Pull Request #16352