[HIVE-25795] [CVE-2021-44228] Update log4j2 version to 2.15.0

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 3.1.2, 4.0.0
• Fix Version/s: 4.0.0-alpha-1
• Component/s: Logging
• Labels: pull-request-available release-3.1.3
• Assignee: Jota Martos
• Reporter: Nikhil Gupta
• Created: 10/Dec/21 10:51
• Updated: 17/Nov/22 08:47
• Resolved: 12/Dec/21 16:24

Description

Worst Apache Log4j RCE Zero day Dropped on Internet - Cyber Kendra

Vulnerability:
https://github.com/apache/logging-log4j2/commit/7fe72d6

Issue Links

• duplicates: HIVE-25797 log4j2 has a critical RCE vulnerability CVE-2021-44228
• incorporates: HIVE-25802 Log4j2 Vulnerability in Hive Storage API
• is related to: HIVE-25810 upgrade to log4j 2.16.0 - another CVE: CVE-2021-45046
• relates to: BIGTOP-3615 Upgrade log4j2 of Hive 3.1.2 to 2.16.0
• relates to: HIVE-25824 Upgrade branch-2.3 to log4j 2.17.0
• links to: GitHub Pull Request #2863
• links to: GitHub Pull Request #2869
• links to: GitHub Pull Request #2876