[YARN-10730] Please upgrade log4j to log4j2

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 3.3.0, 3.2.1, 3.2.2
• Component/s: api, applications, client
• Target Version/s: 3.3.0, 3.4.0
• Assignee: Unassigned
• Reporter: helen huang
• Created: 11/Apr/21 13:39
• Updated: 12/Apr/21 03:47
• Resolved: 12/Apr/21 03:47

Description

The log4j dependency being use by hadoop-common is currently version 1.2.17. Our fortify scan picked up a couple of issue with this dependency. Please update it to the latest version of log4j2 dependencies:

<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
<version>2.14.1</version>
</dependency>

<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>2.14.1</version>
</dependency>

 

The slf4j dependency will need to be updated as well after you upgrade log4j to log4j2.

Issue Links

• duplicates: HADOOP-16206 Migrate from Log4j1 to Log4j2