[KAFKA-13660] Replace log4j with reload4j

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.4.0, 3.0.0
• Fix Version/s: 3.2.0, 3.1.1
• Component/s: logging
• External issue URL: https://github.com/apache/kafka/pull/11743
• Assignee: Mike Lothian
• Reporter: Mike Lothian
• Created: 09/Feb/22 17:02
• Updated: 13/Jan/23 16:43
• Resolved: 30/Mar/22 19:42

Description

Kafka is using a known vulnerable version of log4j, the reload4j project was created by the code's original authors to address those issues. It is designed as a drop in replacement without any api changes

 

https://reload4j.qos.ch/

 

I've raised a merge request, replacing log4j with reload4j, slf4j-log4j12 with slf4j-reload4j and bumping the slf4j version

 

This is my first time contributing to the Kafka project and I'm not too familiar with the process, I'll go back and amend my PR with this issue number

Issue Links

• fixes: KAFKA-14137 Security Vulnerabilities reported in CVE-2021-45046 and CVE-2021-45046
• links to: GitHub Pull Request #11743
• links to: GitHub Pull Request #11956