[HBASE-26560] Address recent the log4j2 CVEs

• Type: Task
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Component/s: community, logging, security
• Assignee: Duo Zhang
• Reporter: Duo Zhang
• Created: 11/Dec/21 13:00
• Updated: 28/Jan/22 13:25
• Resolved: 28/Jan/22 13:25

Description

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105

Issue Links

• is a parent of: HBASE-26557 log4j2 has a critical RCE vulnerability
• is a parent of: HBASE-26561 [hbase-operator-tools] Upgrade log4j2 to 2.15.0 to address CVE-2021-44228
• is a parent of: HBASE-26606 Upgrade log4j2 to 2.17.0
• is a parent of: HBASE-26608 [hbase-operator-tools] Upgrade log4j2 to 2.17.0
• is a parent of: HBASE-26111 Release 3.0.0-alpha-2
• is a parent of: HBASE-26562 Release hbase-operator-tools 1.2.0
• is a parent of: HBASE-26570 Upgrade to log4j 2.16.0