Re: How to address log4j vulnerability in Storm 1.2.2

[Carmen Molatch]

Hello Rui.  Thanks for your response.  I implemented the change recommended in 
your link several weeks ago, however, the company is asking to upgrade the 
log4j* files to 2.17.1.  So, can I simply replace the 2.8.2 log4j* files in 
Storm 1.2.2. or do I upgrade.  I checked the latest storm release and it 
doesn’t have the updated 2.17.1 log4j* files yet.

Thanks

Carmen

> On Jan 11, 2022, at 1:41 PM, Carmen Molatch <cmola...@comcast.net> wrote:
> 
> Hello
> 
> We have Storm 1.2.2.  Do I need to upgrade to a later version or can I 
> replace the log4j* files (2.8.2) with the latest 2.17.1 files?  Is that 
> advisable or should it be avoided?
> 
> Thank you
> 
> Carmen