[HUDI-3090] Make sure Hudi doesn't use affected log4j2 version

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Unresolved
• Fix Version/s: 0.11.0
• Labels: vulnerability
• Assignee: Alexey Kudinkin
• Reporter: Alexey Kudinkin
• Created: 22/Dec/21 00:16
• Updated: 22/Dec/21 00:21

Description

It's been recently reported that JNDI features of log4j2 versions >= 2-beta9 <= 2.15 are affected by 0-day vulnerability that might execute arbitrary code iff attacker's string will get logged.

More details could be found here:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228

 

We need to make sure that neither of this versions is present in Hudi's direct/transitive deps.