[NIFI-9505] Upgrade Log4j 2 to 2.17.0

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 1.16.0, 1.15.2
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 18/Dec/21 20:38
• Updated: 22/Dec/21 23:25
• Resolved: 19/Dec/21 18:21

Description

Log4j 2 version 2.17.0 addresses a potential vulnerability in non-standard logging configurations using Thread Context Map lookup capabilities, described in CVE-2021-45105.

Although NiFi does not use Log4j 2 for runtime logging, upgrading to version 2.17.0 avoids potential references to older versions in external components.

Issue Links

• links to: GitHub PR 5615