bharos opened a new pull request, #11506: URL: https://github.com/apache/gravitino/pull/11506
### What changes were proposed in this pull request? Add a global `exclude(group = "log4j", module = "log4j")` in the root `configurations.all` block to prevent the vulnerable Log4j 1.x artifact from being resolved anywhere in the project. ### Why are the changes needed? Hive 2.3.9 and Hadoop 2.10.2 transitively pull in `log4j:log4j:1.2.x`, which is vulnerable to [CVE-2020-9493](https://nvd.nist.gov/vuln/detail/CVE-2020-9493) (CVSS 9.8 — deserialization flaw in Apache Chainsaw/Log4j 1.x `SocketServer`). The safe `log4j-1.2-api` bridge from Log4j 2.x is already included in the log4j bundle (`libs.versions.toml`), so this exclusion does not break any logging functionality. No source files in the project import `org.apache.log4j`. PR #10465 already excludes `log4j` from `hive-metastore2-libs` and `hive-metastore3-libs`, but `hive-metastore-common` and other modules still resolve it. This change makes the exclusion global. Fix: #10457 ### Does this PR introduce _any_ user-facing change? No. This only removes a vulnerable transitive dependency that is already replaced by the `log4j-1.2-api` bridge. ### How was this patch tested? 1. Verified `./gradlew :catalogs:hive-metastore-common:compileJava :catalogs:hive-metastore2-libs:compileJava :catalogs:hive-metastore3-libs:compileJava :catalogs:catalog-hive:compileJava` passes (BUILD SUCCESSFUL). 2. Confirmed `log4j:log4j` no longer appears in the dependency tree. 3. Confirmed zero source imports of `org.apache.log4j` across the entire project. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
