Merge remote-tracking branch 'origin/feature-2.1.2-fix-log4j' into de…

…velop
FederatedAI · Dec 16, 2021 · c2228cc · c2228cc
2 parents d628d00 + afab482
commit c2228cc
Show file tree

Hide file tree

Showing 11 changed files with 54 additions and 13 deletions.
diff --git a/RELEASE.md b/RELEASE.md
@@ -1,3 +1,7 @@
+# Release 2.1.2
+## Major Features and Improvements
+* Fix serious security vulnerabilities in log4j.
+
 # Release 2.1.1
 ## Major Features and Improvements
 * Fix the bug that the serving-server service fails to start when zookeeper is not used as the service registration and coordination center.

diff --git a/document/docs/quickstart/quickstart.md b/document/docs/quickstart/quickstart.md
@@ -15,9 +15,9 @@ $ mvn clean package
 随后拷贝，比如 serving-server/target/fate-serving-server-{version}-release.zip 到想要部署的路径下，并解压。（version为当前版本号）
 
 用户也可选择下载已编译好的版本，链接如下:   
-•	[fate-serving-server-2.1.1-release.zip](https://webank-ai-1251170195.cos.ap-guangzhou.myqcloud.com/fate-serving-server-2.1.1-release.zip)  
-•	[fate-serving-proxy-2.1.1-release.zip](https://webank-ai-1251170195.cos.ap-guangzhou.myqcloud.com/fate-serving-proxy-2.1.1-release.zip)    
-•	[fate-serving-admin-2.1.1-release.zip](https://webank-ai-1251170195.cos.ap-guangzhou.myqcloud.com/fate-serving-admin-2.1.1-release.zip)  
+•	[fate-serving-server-2.1.2-release.zip](https://webank-ai-1251170195.cos.ap-guangzhou.myqcloud.com/fate-serving-server-2.1.2-release.zip)  
+•	[fate-serving-proxy-2.1.2-release.zip](https://webank-ai-1251170195.cos.ap-guangzhou.myqcloud.com/fate-serving-proxy-2.1.2-release.zip)    
+•	[fate-serving-admin-2.1.2-release.zip](https://webank-ai-1251170195.cos.ap-guangzhou.myqcloud.com/fate-serving-admin-2.1.2-release.zip)  
 
 
 ### zookeeper部署

diff --git a/document/docs/release/change_log.md b/document/docs/release/change_log.md
@@ -1,3 +1,8 @@
+## FATE-SERVING 2.1.2
+```text
+1.修复log4j的严重安全漏洞。
+```
+
 ## FATE-SERVING 2.1.1 
 ```text
 1.修复不使用zookeeper作为服务注册和协调中心的情况下，serving-server服务启动失败的BUG。

diff --git a/document/docs/service/client.md b/document/docs/service/client.md
@@ -1,12 +1,12 @@
 FATE-Serving提供了fate-serving-client工具
 ### 下载对应版本的fate-serving-client
->linux版本：[fate-serving-client-2.1.1-linux.tar.gz](https://webank-ai-1251170195.cos.ap-guangzhou.myqcloud.com/fate-serving-client-2.1.1-linux.tar.gz )     
->mac版本：[fate-serving-client-2.1.1-darwin.tar.gz](https://webank-ai-1251170195.cos.ap-guangzhou.myqcloud.com/fate-serving-client-2.1.1-darwin.tar.gz)
+>linux版本：[fate-serving-client-2.1.2-linux.tar.gz](https://webank-ai-1251170195.cos.ap-guangzhou.myqcloud.com/fate-serving-client-2.1.2-linux.tar.gz )     
+>mac版本：[fate-serving-client-2.1.2-darwin.tar.gz](https://webank-ai-1251170195.cos.ap-guangzhou.myqcloud.com/fate-serving-client-2.1.2-darwin.tar.gz)
 
-需要先确认下载解压出来的文件有没有可执行权限，没有权限就执行 `chmod +777 fate-serving-client-2.1.1-linux`授权。
+需要先确认下载解压出来的文件有没有可执行权限，没有权限就执行 `chmod +777 fate-serving-client-2.1.2-linux`授权。
 
 ### 启动client    
-在终端中使用`./fate-serving-client-2.1.1-linux`启动client  
+在终端中使用`./fate-serving-client-2.1.2-linux`启动client  
 ![connect](../img/client-connect.jpg)
 
 ### 提供了以下几种指令   

diff --git a/fate-serving-admin-ui/package.json b/fate-serving-admin-ui/package.json
@@ -1,6 +1,6 @@
 {
   "name": "FATE-Serving",
-  "version": "2.1.1",
+  "version": "2.1.2",
   "private": true,
   "author": "FATE Serving",
   "scripts": {

diff --git a/fate-serving-admin/bin/service.sh b/fate-serving-admin/bin/service.sh
@@ -24,7 +24,7 @@ basepath=$(cd `dirname $0`;pwd)
 configpath=$(cd $basepath/conf;pwd)
 module=serving-admin
 main_class=com.webank.ai.fate.serving.admin.Bootstrap
-module_version=2.1.1
+module_version=2.1.2
 
 case "$1" in
     start)

diff --git a/fate-serving-core/src/main/java/com/webank/ai/fate/serving/core/bean/MetaInfo.java b/fate-serving-core/src/main/java/com/webank/ai/fate/serving/core/bean/MetaInfo.java
@@ -24,7 +24,7 @@
 import java.util.Map;
 
 public class MetaInfo {
-    public static final long CURRENT_VERSION = 211;
+    public static final long CURRENT_VERSION = 212;
     public static List<AdaptorDescriptor.ParamDescriptor> inferenceParamDescriptorList;
     public static List<AdaptorDescriptor.ParamDescriptor> batchInferenceParamDescriptorList;
     public static Boolean PROPERTY_REMOTE_MODEL_INFERENCE_RESULT_CACHE_SWITCH;

diff --git a/fate-serving-proxy/bin/service.sh b/fate-serving-proxy/bin/service.sh
@@ -24,7 +24,7 @@ basepath=$(cd `dirname $0`;pwd)
 configpath=$(cd $basepath/conf;pwd)
 module=serving-proxy
 main_class=com.webank.ai.fate.serving.proxy.bootstrap.Bootstrap
-module_version=2.1.1
+module_version=2.1.2
 
 
 case "$1" in

diff --git a/fate-serving-register/pom.xml b/fate-serving-register/pom.xml
@@ -40,6 +40,10 @@
                     <artifactId>slf4j-log4j12</artifactId>
                     <groupId>org.slf4j</groupId>
                 </exclusion>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
 

diff --git a/fate-serving-server/bin/service.sh b/fate-serving-server/bin/service.sh
@@ -24,7 +24,7 @@ basepath=$(cd `dirname $0`;pwd)
 configpath=$(cd $basepath/conf;pwd)
 module=serving-server
 main_class=com.webank.ai.fate.serving.Bootstrap
-module_version=2.1.1
+module_version=2.1.2
 
 
 case "$1" in

diff --git a/pom.xml b/pom.xml
@@ -37,7 +37,7 @@
     </modules>
 
     <properties>
-        <fate.version>2.1.1</fate.version>
+        <fate.version>2.1.2</fate.version>
         <java.version>1.8</java.version>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
@@ -50,6 +50,7 @@
         <spring.boot.version>2.2.0.RELEASE</spring.boot.version>
         <jackson.version>2.10.0</jackson.version>
         <jedis.version>2.9.0</jedis.version>
+        <log4j2.version>2.16.0</log4j2.version>
         <skipTests>true</skipTests>
     </properties>
 
@@ -264,6 +265,33 @@
                 <artifactId>jackson-dataformat-properties</artifactId>
                 <version>2.9.4</version>
             </dependency>
+
+            <dependency>
+                <groupId>org.apache.logging.log4j</groupId>
+                <artifactId>log4j-api</artifactId>
+                <version>${log4j2.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.logging.log4j</groupId>
+                <artifactId>log4j-core</artifactId>
+                <version>${log4j2.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.logging.log4j</groupId>
+                <artifactId>log4j-slf4j-impl</artifactId>
+                <version>${log4j2.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.logging.log4j</groupId>
+                <artifactId>log4j-jul</artifactId>
+                <version>${log4j2.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.slf4j</groupId>
+                <artifactId>jul-to-slf4j</artifactId>
+                <version>1.7.32</version>
+            </dependency>
+
         </dependencies>
     </dependencyManagement>