[HIVE-25839] Upgrade Log4j2 to 2.17.1 due to CVE-2021-44832

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.1.2
• Fix Version/s: 4.0.0-alpha-1
• Labels: pull-request-available
• Target Version/s: 4.0.0
• Assignee: Hankó Gergely
• Reporter: weidong
• Created: 04/Jan/22 03:28
• Updated: 01/Dec/22 09:15
• Resolved: 10/Jan/22 11:23

Description

High security vulnerability in Log4J - CVE-2021-44832 bundled with Hive

Issue Links

• Blocked: HIVE-25853 Security Vulnerability CVE-2021-44832 log4j2 need upgrade to 2.17.1
• duplicates: HIVE-25853 Security Vulnerability CVE-2021-44832 log4j2 need upgrade to 2.17.1
• is cloned by: HIVE-26568 Upgrade Log4j2 to 2.18.0 due to CVEs
• Is contained by: HIVE-26751 Bug Fixes and Improvements for 3.2.0 release
• is duplicated by: HIVE-25876 Update log4j2 version to 2.17.1
• is duplicated by: HIVE-25802 Log4j2 Vulnerability in Hive Storage API
• is duplicated by: HIVE-25821 upgrade to log4j 2.17.0 - another CVE: CVE-2021-45105
• links to: GitHub Pull Request #2912
• links to: GitHub Pull Request #2930