[STORM-3809] CVE-2021-44228 Log4Shell: upgrade log4j2

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Duplicate
• Affects Version/s: 2.3.0, 2.2.1
• Component/s: storm-core
• Flags: Important
• Assignee: Unassigned
• Reporter: Antoine Tran
• Created: 14/Dec/21 15:07
• Updated: 16/Jan/22 20:42
• Resolved: 16/Jan/22 20:41

Description

Recent critical CVE about log4shell (https://www.cvedetails.com/cve/CVE-2021-44228/) affects Storm. (Eg: in Storm 2.2.0, it uses log4j-api-2.11.2.jar) Any log4j2 between 2.0 and 2.14 is affected.

 

I did not found any issue or news related to Apache Storm and a fix. So I create this ticket to track it down.

Please upgrade to latest Log4j2 >= 2.16.0 (see https://search.maven.org/artifact/org.apache.logging.log4j/log4j/2.16.0/pom) in both 2.2.X and 2.3.X Storm branches. Thank you!

 

Issue Links

• is related to: STORM-3810 CVE-2021-44228 Log4J vulnerability