[HIVE-25825] upgrade log4j 2.16.0 to 2.17.0+ due to CVE-2021-45105

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 4.0.0
• Fix Version/s: 4.0.0-alpha-1
• Component/s: Hive, Standalone Metastore
• Labels: pull-request-available release-3.1.3
• Target Version/s: 4.0.0
• Assignee: renjianting
• Reporter: renjianting
• Created: 20/Dec/21 12:39
• Updated: 17/Nov/22 08:48
• Resolved: 23/Dec/21 05:18

Description

upgrade log4j 2.16.0 to 2.17.0+ due to CVE-2021-45105

CVE - CVE-2021-45105 (mitre.org)：https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105

Issue Links

• depends upon: HIVE-25804 Update log4j2 version to 2.16.0 to incorporate further CVE-2021-44228 hardening
• links to: GitHub Pull Request #2901