[PHOENIX-6636] Replace bundled log4j libraries with reload4j

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 5.2.0
• Fix Version/s: 4.17.0, 5.2.0, 4.16.2, 5.1.3
• Component/s: connectors, core
• Assignee: Istvan Toth
• Reporter: Istvan Toth
• Created: 31/Jan/22 08:40
• Updated: 07/Jun/22 08:07
• Resolved: 07/Jun/22 08:07

Description

To reduce the number of dependecies with unresolved CVEs, replace the bundled log4j libraries with reload4j (https://reload4j.qos.ch/).
This will also require bumping the slf4j version.

This is a quick fix, and does not preclude moving to some different backend later (like log4j2 or logback)

Issue Links

• causes: PHOENIX-6697 log4j-reload4j is missing from phoenix-assembly
• relates to: PHOENIX-6660 Ship reload4j in queryserver assembly
• links to: GitHub Pull Request #1379
• links to: PR for Phoenix