[HADOOP-17632] Please upgrade the log4j dependency to log4j2

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 3.3.0
• Component/s: common
• Target Version/s: 3.3.0, 3.4.0
• Assignee: Unassigned
• Reporter: helen huang
• Created: 11/Apr/21 13:29
• Updated: 12/Apr/21 03:53
• Resolved: 12/Apr/21 03:53

Description

The log4j dependency being use by hadoop-common is currently version 1.2.17. Our fortify scan picked up a couple of issues with this dependency. Please upgrade it to the latest version of log4j2 dependencies:

<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
<version>2.14.1</version>
</dependency>

<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>2.14.1</version>
</dependency>

 

The slf4j dependency will need to be updated as well after you upgrade log4j to log4j2.

 

 

Issue Links

• duplicates: HADOOP-16206 Migrate from Log4j1 to Log4j2