Jing Zhang created FLINK-25258: ---------------------------------- Summary: Update log4j2 version to avoid Key: FLINK-25258 URL: https://issues.apache.org/jira/browse/FLINK-25258 Project: Flink Issue Type: Bug Affects Versions: 1.14.0, 1.13.0, 1.12.0, 1.11.0 Reporter: Jing Zhang Fix For: 1.15.0
2.0 <= Apache log4j2 <= 2.14.1 have a RCE zero day. https://www.cyberkendra.com/2021/12/worst-log4j-rce-zeroday-dropped-on.html https://www.lunasec.io/docs/blog/log4j-zero-day/ Flink has switched to Log4j 2 since 1.11 version. -- This message was sent by Atlassian Jira (v8.20.1#820001)