You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@hudi.apache.org by "Alexey Kudinkin (Jira)" <ji...@apache.org> on 2021/12/22 00:17:00 UTC

[jira] [Updated] (HUDI-3090) Make sure Hudi doesn't use affected log4j2 version

     [ https://issues.apache.org/jira/browse/HUDI-3090?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Alexey Kudinkin updated HUDI-3090:
----------------------------------
    Fix Version/s: 0.11.0

> Make sure Hudi doesn't use affected log4j2 version
> --------------------------------------------------
>
>                 Key: HUDI-3090
>                 URL: https://issues.apache.org/jira/browse/HUDI-3090
>             Project: Apache Hudi
>          Issue Type: Bug
>            Reporter: Alexey Kudinkin
>            Assignee: Alexey Kudinkin
>            Priority: Blocker
>             Fix For: 0.11.0
>
>
> It's been recently reported that JNDI features of log4j2 versions >= 2-beta9 <= 2.15 are affected by 0-day vulnerability that might execute arbitrary code iff attacker's string will get logged.
> More details could be found here:
> [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228]
>  
> We need to make sure that neither of this versions is present in Hudi's direct/transitive deps.



--
This message was sent by Atlassian Jira
(v8.20.1#820001)