[
https://issues.apache.org/jira/browse/BEAM-11055?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17353340#comment-17353340
]
Ismaël Mejía commented on BEAM-11055:
-------------------------------------
Since we were moving Beam to vendored gRPC 1.36.0 I expected the vendored size
to be solved there, but apparently it was not. Filled BEAM-12422 to track this,
thanks for the message [~bhulette]
> Update log4j to version 2.14.1
> ------------------------------
>
> Key: BEAM-11055
> URL: https://issues.apache.org/jira/browse/BEAM-11055
> Project: Beam
> Issue Type: Improvement
> Components: build-system, io-java-elasticsearch
> Reporter: Ismaël Mejía
> Assignee: Ismaël Mejía
> Priority: P3
> Fix For: 2.30.0
>
> Time Spent: 20h 10m
> Remaining Estimate: 0h
>
> Beam uses a version of log4j that is reported by some security tools to have
> some security issues. Notice that Beam's use of log4j should not be impacted
> by the issue.
> See [https://nvd.nist.gov/vuln/detail/CVE-2017-5645]
> The update in the vendored grpc module is to ensure it gets updated too in a
> future release of our vendored dependencies. Notice that this is a runtime
> dep for users so they are free to provide their own version so less of an
> issue.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
