[HDFS-15965] Please upgrade the log4j dependency to log4j2

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 3.3.0, 3.2.1, 3.2.2
• Component/s: dfsclient
• Target Version/s: 3.3.9
• Assignee: Unassigned
• Reporter: helen huang
• Created: 11/Apr/21 13:35
• Updated: 29/Nov/22 15:51

Description

The log4j dependency being use by hadoop-common is currently version 1.2.17. Our fortify scan picked up a couple of issue with this dependency. Please update it to the latest version of log4j2 dependencies:

<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
<version>2.14.1</version>
</dependency>

<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>2.14.1</version>
</dependency>

 

The slf4j dependency will need to be updated as well after you upgrade log4j to log4j2.

Issue Links

• is related to: HADOOP-16206 Migrate from Log4j1 to Log4j2