bharos opened a new issue, #11899:
URL: https://github.com/apache/gravitino/issues/11899
### What
The Flink connector modules (`v1.18`/`v1.19`/`v1.20`) declare
`org.apache.hive:hive-common:2.3.9` as a `compileOnly` dependency, which
transitively pulls `org.apache.logging.log4j:log4j-core:2.6.2` (Log4Shell,
CVE-2021-44228) onto the compile classpath.
`flink-common` already excludes `org.apache.logging.log4j` from its Hive
dependencies, but the versioned Flink modules' `hive2.common` block does not.
### Proposal
Add `exclude("org.apache.logging.log4j")` to the
`compileOnly(libs.hive2.common)` block in the three modules, matching the
existing `flink-common` pattern. Runtime is unaffected — the `flink-runtime`
shadow jar already forbids `org.apache.logging.log4j`, and the connector logs
via SLF4J.
Fixed by #11898.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
