Jinzhong Li created FLINK-25314: ----------------------------------- Summary: Update log4j2 version to 2.16.0 Key: FLINK-25314 URL: https://issues.apache.org/jira/browse/FLINK-25314 Project: Flink Issue Type: Improvement Reporter: Jinzhong Li
The description of the new vulnerability, [CVE 2021-45046|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046], says the fix to address [CVE-2021-44228|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228] in Apache Log4j 2.15.0 was "incomplete in certain non-default configurations." I think we need update log4j2 version to 2.16.0 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046 [https://www.zdnet.com/article/second-log4j-vulnerability-found-apache-log4j-2-16-0-released/] https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-core/2.16.0/ -- This message was sent by Atlassian Jira (v8.20.1#820001)