[HBASE-26557] log4j2 has a critical RCE vulnerability

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.0.0-alpha-2
• Component/s: logging, security
• Hadoop Flags: Reviewed
• Release Note: Upgrade log4j2 to 2.15.0 for addressing CVE-2021-44228.
• Assignee: Yutong Xiao
• Reporter: Yutong Xiao
• Created: 10/Dec/21 04:09
• Updated: 19/Dec/21 06:06
• Resolved: 14/Dec/21 00:12

Description

Impacted log4j version: Apache Log4j 2.x <= 2.14.1
I found that our current log4j version at master is 2.14.1.
Should upgrade the version to 2.15.0

Issue Links

• is a child of: HBASE-26560 Address recent the log4j2 CVEs
• links to: GitHub Pull Request #95
• links to: GitHub Pull Request #3933
• links to: GitHub Pull Request #3941