You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@flink.apache.org by ch...@apache.org on 2020/01/22 09:07:25 UTC
[flink-shaded] branch master updated: [hotfix][hadoop] Add log4j
exclusions
This is an automated email from the ASF dual-hosted git repository.
chesnay pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/flink-shaded.git
The following commit(s) were added to refs/heads/master by this push:
new 4e9fca8 [hotfix][hadoop] Add log4j exclusions
4e9fca8 is described below
commit 4e9fca8cde7b9705f6bebaeac0161ab28784b3b1
Author: Chesnay Schepler <ch...@apache.org>
AuthorDate: Wed Jan 22 10:07:10 2020 +0100
[hotfix][hadoop] Add log4j exclusions
THe log4j version used by hadoop is picked up by security checks as vulnerable. These are false positives since we don't bundle log4j (excluded by the shade-plugin).
Adding an explicit exclusion on the dependency should ease security audits.
---
.../flink-shaded-hadoop-2/pom.xml | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/flink-shaded-hadoop-2-parent/flink-shaded-hadoop-2/pom.xml b/flink-shaded-hadoop-2-parent/flink-shaded-hadoop-2/pom.xml
index 3d50db4..fa9fecb 100644
--- a/flink-shaded-hadoop-2-parent/flink-shaded-hadoop-2/pom.xml
+++ b/flink-shaded-hadoop-2-parent/flink-shaded-hadoop-2/pom.xml
@@ -180,6 +180,10 @@ under the License.
<groupId>commons-beanutils</groupId>
<artifactId>commons-beanutils</artifactId>
</exclusion>
+ <exclusion>
+ <groupId>log4j</groupId>
+ <artifactId>log4j</artifactId>
+ </exclusion>
</exclusions>
</dependency>
@@ -300,6 +304,10 @@ under the License.
<groupId>com.sun.jersey.contribs</groupId>
<artifactId>jersey-guice</artifactId>
</exclusion>
+ <exclusion>
+ <groupId>log4j</groupId>
+ <artifactId>log4j</artifactId>
+ </exclusion>
</exclusions>
</dependency>
@@ -548,6 +556,10 @@ under the License.
<groupId>com.sun.jersey.contribs</groupId>
<artifactId>jersey-guice</artifactId>
</exclusion>
+ <exclusion>
+ <groupId>log4j</groupId>
+ <artifactId>log4j</artifactId>
+ </exclusion>
</exclusions>
</dependency>
@@ -676,6 +688,10 @@ under the License.
<groupId>com.google.inject</groupId>
<artifactId>guice</artifactId>
</exclusion>
+ <exclusion>
+ <groupId>log4j</groupId>
+ <artifactId>log4j</artifactId>
+ </exclusion>
</exclusions>
</dependency>
</dependencies>