[RATIS-1501] Exclude log4j JMSSink, JDBCAppender, and Chainsaw from the generated jar

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Implemented
• Fix Version/s: 2.3.0
• Component/s: build
• Assignee: Tsz-wo Sze
• Reporter: Tsz-wo Sze
• Created: 23/Jan/22 04:33
• Updated: 24/Jan/22 09:14
• Resolved: 24/Jan/22 09:14

Description

log4j 1.2.17 has the following vulnerabilities:

• CVE-2022-23302: JMSSink
• CVE-2022-23305 : JDBCAppender
• CVE-2022-23307 : Chainsaw

We should exclude the related classes from the generated jars.

Issue Links

• relates to: RATIS-1499 Is Apache Ratis 2.2.0 affected by the high-risk vulnerability of the log4j 1.X series?
• links to: GitHub Pull Request #589