HIVE-25824: Upgrade log4j dependencies to 2.17.0

[elukey]

What changes were proposed in this pull request?

This change should mimic what done in the 3.x and master branches to fix the various CVEs related to log4j.

How was this patch tested?

The Apache Bigtop project used the same patch on top of 2.3.6 (released with Bigtop 1.5) and all our build/smoke-tests passed.
More info apache/bigtop#844

[elukey]

Running mvn clean install leads me to:

[INFO]  T E S T S
[INFO] -------------------------------------------------------
[INFO] Running org.apache.hadoop.hive.llap.tezplugins.TestLlapTaskSchedulerService
[INFO] Tests run: 24, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 6.385 s - in org.apache.hadoop.hive.llap.tezplugins.TestLlapTaskSchedulerService
[INFO] Running org.apache.hadoop.hive.llap.tezplugins.TestLlapTaskCommunicator
[ERROR] Tests run: 2, Failures: 0, Errors: 1, Skipped: 0, Time elapsed: 1.075 s <<< FAILURE! - in org.apache.hadoop.hive.llap.tezplugins.TestLlapTaskCommunicator
[ERROR] org.apache.hadoop.hive.llap.tezplugins.TestLlapTaskCommunicator.testFinishableStateUpdateFailure  Time elapsed: 1.025 s  <<< ERROR!
java.lang.NullPointerException
	at org.apache.hadoop.hive.llap.daemon.rpc.LlapDaemonProtocolProtos$SignableVertexSpec$Builder.setUser(LlapDaemonProtocolProtos.java:4842)
	at org.apache.hadoop.hive.llap.tez.Converters.constructSignableVertexSpec(Converters.java:135)
	at org.apache.hadoop.hive.llap.tezplugins.LlapTaskCommunicator.constructSubmitWorkRequest(LlapTaskCommunicator.java:726)
	at org.apache.hadoop.hive.llap.tezplugins.LlapTaskCommunicator.registerRunningTaskAttempt(LlapTaskCommunicator.java:334)
	at org.apache.hadoop.hive.llap.tezplugins.TestLlapTaskCommunicator$LlapTaskCommunicatorWrapperForTest.registerRunningTaskAttemptWithSourceVertex(TestLlapTaskCommunicator.java:336)
	at org.apache.hadoop.hive.llap.tezplugins.TestLlapTaskCommunicator.testFinishableStateUpdateFailure(TestLlapTaskCommunicator.java:142)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:47)
	at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
	at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:44)
	at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
	at org.junit.internal.runners.statements.FailOnTimeout$StatementThread.run(FailOnTimeout.java:74)

[elukey]

If anybody could help/chime-in I'd be grateful, I think that the errors pointed out above is unrelated to my change (not sure about the one that Travis is complaining about thought).

Edit: I verified and the above test leads to the same failure even without my commit..

[sunchao]

@elukey yes, branch-2.3 currently has a bunch of flaky tests which your PR is probably unrelated.

[elukey]

@sunchao how should we proceed with this pull request?

[sunchao]

Sorry for the late reply @elukey ! it seems the CI run failed due to timeout. Let me re-trigger it first.

[sunchao]

LGTM. I checked the test results and all the failures are known ones.

[sunchao]

Merged to branch-2.3, thanks @elukey !

[elukey]

@sunchao thanks a lot for your support! Is there any chance to get a new release in the future?

[sunchao]

@elukey yes I'll try to start a new release for branch-2.3 soon, perhaps in a few weeks.

[Gingernaut]

@sunchao any updates on when a 3.x branch update might be released? Seems the last release was July 2020, and with the log4j vulnerability it seems it would be a high priority fix to publish a new version for.

[sunchao]

@Gingernaut I believe Naveen is planning to make a 3.x release soon. You can subscribe to https://issues.apache.org/jira/browse/HIVE-25855 for the latest update.

[vrao91]

When checking the version of hive, it's still showing 2.3.6.

bin/hive --version

Hive 2.3.6-amzn-0
Git git://<ip-address>/workspace/workspace/bigtop.release-rpm-5.28.1/build/hive/rpm/BUILD/apache-hive-2.3.6-amzn-0-src -r a3b61461af0d6b4d981c915b0a1f342464987aaa

Compiled by ec2-user on Sat Dec 14 09:17:06 UTC 2019
From source with checksum 308f8d79fe62254ef0c65ed73f5847ca

Any ideas?

[sunchao]

Hive 2.3.6-amzn-0? is not official Apache release though. Where did get it?