Uploaded image for project: 'Apache Storm'
  1. Apache Storm
  2. STORM-3812

Storm release packages log4j v1

    XMLWordPrintableJSON

Details

    • Improvement
    • Status: Closed
    • Major
    • Resolution: Fixed
    • None
    • None
    • None
    • None

    Description

      log4j v1 is at it's EOL, but due to some implicit package references in maven, some tools/libs is still packaging log4j. All latest releases are all being impacted. 

       

      Packages impacted:

      • storm-autocreds
      • storm-kafka-monitor

       

      It would be good to fix/release this together with log4j v2 recent CVEs, thus vulnerability scan will be clear for log4j vulnerability.

       

      Attachments

        Issue Links

          relates to

          Dependency upgrade - Upgrading a dependency to a newer version STORM-3811 Upgrade log4j version to 2.17.1

          • Critical - Crashes, loss of data, severe memory leak.
          • Resolved

          Activity

            People

              Unassigned Unassigned
              1zha0 Liang Zhao
              Votes:
              1 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 40m
                  40m