[FLINK-25394] [Flink-ML] Upgrade log4j to 2.17.0 to address CVE-2021-45105

• Type: Improvement
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: ml-2.0.0
• Fix Version/s: ml-2.0.0
• Component/s: Library / Machine Learning
• Labels: pull-request-available
• Assignee: Abdelrahman
• Reporter: Abdelrahman
• Created: 20/Dec/21 16:05
• Updated: 23/Dec/21 07:41
• Resolved: 22/Dec/21 11:12

Description

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 did not protect from uncontrolled recursion from self-referential lookups. When the logging configuration uses a non-default Pattern Layout with a Context Lookup (for example, $${ctx:loginId}), attackers with control over Thread Context Map (MDC) input data can craft malicious input data that contains a recursive lookup, resulting in a StackOverflowError that will terminate the process. This is also known as a DOS (Denial of Service) attack.

Issue Links

• links to: GitHub Pull Request #42