[SPARK-37684] Upgrade log4j to 2.17

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.3.0
• Fix Version/s: 3.3.0
• Component/s: Build
• Assignee: L. C. Hsieh
• Reporter: L. C. Hsieh
• Created: 18/Dec/21 17:41
• Updated: 05/Jan/22 04:29
• Resolved: 19/Dec/21 01:06

Description

There is another CVE in 2.16: https://logging.apache.org/log4j/2.x/security.html. We should upgrade to log4j 2.17.

Issue Links

• is related to: SPARK-6305 Add support for log4j 2.x to Spark
• links to: [Github] Pull Request #34948 (viirya)
• links to: [Github] Pull Request #34948 (viirya)