[BIGTOP-3621] Bump Oozie's log4j dependencies to 2.17.0

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.5.0, 3.0.0
• Fix Version/s: 1.5.1
• Assignee: Luca Toscano
• Reporter: Luca Toscano
• Created: 20/Dec/21 10:11
• Updated: 29/Dec/21 10:01
• Resolved: 28/Dec/21 21:18

Description

In Bigtop 1.5 Oozie seems to include log4j 2.6.x jars:

$ dpkg -L oozie | egrep *log4j.*2.6.*
/usr/lib/oozie/lib/log4j-api-2.6.2.jar
/usr/lib/oozie/lib/log4j-core-2.6.2.jar
/usr/lib/oozie/lib/log4j-slf4j-impl-2.6.2.jar
/usr/lib/oozie/lib/log4j-web-2.6.2.jar

On vanilla Oozie branch-4.3's dependency:tree I can find a reference to the lib, but from the Bigtop's build log it seems pulled in by the hcatalog pom.xml.

I quickly tried to exclude the log4j dependency and it worked (no extra log4j jars in the .deb), but it is probably not the right fix since the hive dependencies may need a more up-to-date log4j version.

We should also review Oozie's 5.x version for Bigtop 3.x

Issue Links

• relates to: BIGTOP-3613 Review log4j configurations for CVE-2021-44228