[BIGTOP-3613] Review log4j configurations for CVE-2021-44228

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.1.0
• Fix Version/s: 3.1.0
• Assignee: Luca Toscano
• Reporter: Luca Toscano
• Created: 11/Dec/21 11:21
• Updated: 25/Apr/22 15:42
• Resolved: 25/Apr/22 15:42

Description

Due to CVE-2021-44228, it would be great to avoid shipping 3.1 with the affected log4j versions, or alternatively to apply the workarounds to patch the issue (like -Dlog4j2.formatMsgNoLookups=true etc..)

More info: https://github.com/advisories/GHSA-jfh8-c2jp-5v3q

Issue Links

• is related to: BIGTOP-3615 Upgrade log4j2 of Hive 3.1.2 to 2.16.0
• is related to: BIGTOP-3616 Bump Flink to 1.11.6
• is related to: BIGTOP-3618 Bump Solr to 8.11.1
• is related to: BIGTOP-3619 Upgrade hive 2.3.6 to log4j 2.17.0
• is related to: BIGTOP-3621 Bump Oozie's log4j dependencies to 2.17.0
• is related to: BIGTOP-3624 Bump Alluxio's log4j dependencies to 2.17.0
• is related to: BIGTOP-3626 Patch log4j version of ycsb
• is related to: BIGTOP-3632 Bump elasticsearch's log4j dependencies to 2.17.0
• is related to: BIGTOP-3635 Bump logstash's log4j dependencies to 2.17.0
• is related to: BIGTOP-3640 Upgrade hive's log4j2 version to 2.17.1 for Bigtop 3.0.x
• is related to: BIGTOP-3642 Upgrade log4j to 2.17.1 on all components
• is related to: BIGTOP-3646 Upgrade Geode and TableStore SDK version for YCSB
• links to: Apache projects affected by log4j CVE-2021-44228