[BIGTOP-3642] Upgrade log4j to 2.17.1 on all components

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.1.0, 3.0.1
• Component/s: flink, hive, solr
• Assignee: Kengo Seki
• Reporter: Kengo Seki
• Created: 15/Feb/22 01:52
• Updated: 15/Feb/22 19:02
• Resolved: 15/Feb/22 06:11

Description

At this point of time, all components use log4j 2.16.0+ on branch-3.0 and master so CVE-2021-44228 and CVE-2021-45046 have already been addressed (thanks a lot elukey yoda-mon iwasakims!).
It is better to upgrade them to 2.17.1 before the release for addressing CVE-2021-45105 and CVE-2021-44832.

Issue Links

• relates to: BIGTOP-3613 Review log4j configurations for CVE-2021-44228
• links to: https://github.com/apache/bigtop/pull/863