[WIP] fix flink log4j CVE 2019-17571

[tarzanek]

this is first draft

BUT I'd love to wait few days (latest mid May)
till they release flink 1.11.0
which has a fix for https://issues.apache.org/jira/browse/FLINK-15672
and upgrades log4j to 2

[vladzcloudius]

What is "CVE 2019-17571? It would be a lot easier if the subject would be a little more human readable.

…

On Sun, Apr 19, 2020, 4:14 AM Lubos Kosco ***@***.***> wrote: this is first draft BUT I'd love to wait few days (latest mid May) till they release flink 1.11.0 which has a fix for https://issues.apache.org/jira/browse/FLINK-15672 and upgrades log4j to 2 ------------------------------ You can view, comment on, or merge this pull request online at: #126 Commit Summary - fix CVE 2019-17571 File Changes - *M* flink_streaming_into_scylla/flink-app/.idea/encodings.xml <https://github.com/scylladb/scylla-code-samples/pull/126/files#diff-43df1eaddcd6437aa58a0ff70e27e9a3> (2) - *M* flink_streaming_into_scylla/flink-app/.idea/workspace.xml <https://github.com/scylladb/scylla-code-samples/pull/126/files#diff-32c76d4582758643d64aa3d3c707bd85> (259) - *M* flink_streaming_into_scylla/flink-app/pom.xml <https://github.com/scylladb/scylla-code-samples/pull/126/files#diff-b41ccbdd1449725b08add1b5f5445fea> (10) - *M* flink_streaming_into_scylla/flink-app/src/main/resources/log4j.properties <https://github.com/scylladb/scylla-code-samples/pull/126/files#diff-3e0af47de2c052db1dbbaf5a2ed034fe> (4) Patch Links: - https://github.com/scylladb/scylla-code-samples/pull/126.patch - https://github.com/scylladb/scylla-code-samples/pull/126.diff — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#126>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABOSHLMG6SNWUKWHQYJGZ3TRNKXGTANCNFSM4MLWCZOA> .

[tzach]

https://nvd.nist.gov/vuln/detail/CVE-2019-17571

[tarzanek]

https://mvnrepository.com/artifact/org.slf4j/slf4j-log4j12/1.7.32 is out, please update @tarzanek !