The current version of Zookeeper used an outdatted insecure version of Log4j

apache / incubator-heron

Apache Heron (Incubating) is a realtime, distributed, fault-tolerant stream processing engine from Twitter

https://heron.apache.org/

Apache License 2.0

3.65k stars 597 forks source link

The current version of Zookeeper used an outdatted insecure version of Log4j #3839

Closed nicknezis closed 2 years ago

nicknezis commented 2 years ago

Zookeeper was recently updated to replace Log4j with Reload4j. https://issues.apache.org/jira/browse/ZOOKEEPER-4455?jql=project%20%3D%20ZOOKEEPER%20AND%20text%20~%20reload4j

We include the Zookeeper libraries in the published Heron Docker image. We need to update to Zookeeper 3.6.4 to include the newer maintained Reload4j in our images.