[HIVE-25824] Upgrade branch-2.3 to log4j 2.17.0

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.3.8
• Fix Version/s: 2.3.10
• Labels: pull-request-available
• Hadoop Flags: Reviewed
• Assignee: Luca Toscano
• Reporter: Luca Toscano
• Created: 20/Dec/21 10:35
• Updated: 21/Feb/22 16:51
• Resolved: 13/Jan/22 06:08

Description

Hi everybody,

I am wondering if there are any plans to upgrade branch-2.3 to log4j 2.17.0 as it was done in HIVE-25795 (and related).

In Apache Bigtop we created https://github.com/apache/bigtop/pull/844, since the one before the last release (Bigtop 1.5.0) shipped Hive 2.3.6.

I can try to file a pull request for branch-2.3 adapting what was done for Bigtop (if the branch is still maintained), but I am currently experiencing some mvn package failures (that seem unrelated to log4j) so I'd need some help for you in case

Issue Links

• is related to: HIVE-25795 [CVE-2021-44228] Update log4j2 version to 2.15.0
• links to: GitHub Pull Request #2908