[HADOOP-18088] Replace log4j 1.x with reload4j

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.4.0, 2.10.2, 3.2.4, 3.3.3
• Labels: pull-request-available
• Target Version/s: 3.4.0, 2.10.2, 3.2.3, 3.3.5, 3.3.3
• Hadoop Flags: Reviewed

Release Note

log4j 1 was replaced with reload4j which is fork of log4j 1.2.17 with the goal of fixing pressing security issues.

If you are depending on the hadoop artifacts in your build were explicitly excluding log4 artifacts, and now want to exclude the reload4j files, you will need to update your exclusion lists
<exclusion>
  <groupId>org.slf4j</groupId>
  <artifactId>slf4j-reload4j</artifactId>
</exclusion>
<exclusion>
  <groupId>ch.qos.reload4j</groupId>
  <artifactId>reload4j</artifactId>
</exclusion>

• Assignee: Wei-Chiu Chuang
• Reporter: Wei-Chiu Chuang
• Created: 21/Jan/22 02:10
• Updated: 12/Sep/24 02:56
• Resolved: 18/Apr/22 14:17

Description

As proposed in the dev mailing list (https://lists.apache.org/thread/fdzkv80mzkf3w74z9120l0k0rc3v7kqk) let's replace log4j 1 with reload4j in the maintenance releases (i.e. 3.3.x, 3.2.x and 2.10.x)

Issue Links

• causes: HADOOP-18192 Fix multiple_bindings warning about slf4j-reload4j
• is depended upon by: HADOOP-18198 Release Hadoop 3.3.3: hadoop-3.3.2 with some fixes
• is related to: HADOOP-18290 Fix some compatibility issues with 3.3.3 release notes
• relates to: SPARK-39334 Change to exclude `slf4j-reload4j` for `hadoop-minikdc`
• relates to: HIVE-26579 Prepare for Hadoop and Zookeeper switching to Reload4j
• supercedes: HADOOP-17221 update log4j-1.2.17 to atlassian version( To Address: CVE-2019-17571)
• links to: GitHub Pull Request #3906
• links to: GitHub Pull Request #4052
• links to: GitHub Pull Request #4084
• links to: GitHub Pull Request #4151
• links to: GitHub Pull Request #4399
• links to: GitHub Pull Request #6547
• links to: PR#3906