From d3eb1114dc150ee2943ee089b35db1a63bb38219 Mon Sep 17 00:00:00 2001
From: dugujiujiang <2563829168@qq.com>
Date: Wed, 13 Aug 2025 07:30:43 +0800
Subject: [PATCH] BIGTOP-4011. CVE-2022-23307: Apache Log4j security
 vulnerabilities.

---
 bigtop-tests/test-execution/conf/pom.xml | 16 ++++++++++++++--
 pom.xml                                  | 19 +++++++++++++++----
 2 files changed, 29 insertions(+), 6 deletions(-)

diff --git a/bigtop-tests/test-execution/conf/pom.xml b/bigtop-tests/test-execution/conf/pom.xml
index 6f3f3eb4a4..0fafb33cc7 100644
--- a/bigtop-tests/test-execution/conf/pom.xml
+++ b/bigtop-tests/test-execution/conf/pom.xml
@@ -32,8 +32,20 @@
 
   <dependencies>
     <dependency>
-      <groupId>log4j</groupId>
-      <artifactId>log4j</artifactId>
+      <groupId>org.apache.logging.log4j</groupId>
+      <artifactId>log4j-api</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.logging.log4j</groupId>
+      <artifactId>log4j-core</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.logging.log4j</groupId>
+      <artifactId>log4j-1.2-api</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.logging.log4j</groupId>
+      <artifactId>log4j-slf4j-impl</artifactId>
     </dependency>
   </dependencies>
 </project>
diff --git a/pom.xml b/pom.xml
index 4a79ac6515..bb448c9740 100644
--- a/pom.xml
+++ b/pom.xml
@@ -60,7 +60,7 @@
     <commons.logging.version>1.1</commons.logging.version>
     <junit.version>4.11</junit.version>
     <slf4j.version>1.6.6</slf4j.version>
-    <log4j.version>1.2.14</log4j.version>
+    <log4j2.version>2.17.1</log4j2.version>
     <antlr.version>3.4</antlr.version>
     <cxf.version>2.5.0</cxf.version>
 
@@ -114,9 +114,20 @@
         <version>${slf4j.version}</version>
       </dependency>
       <dependency>
-        <groupId>log4j</groupId>
-        <artifactId>log4j</artifactId>
-        <version>1.2.14</version>
+        <groupId>org.apache.logging.log4j</groupId>
+        <artifactId>log4j-api</artifactId>
+      </dependency>
+      <dependency>
+        <groupId>org.apache.logging.log4j</groupId>
+        <artifactId>log4j-core</artifactId>
+      </dependency>
+      <dependency>
+        <groupId>org.apache.logging.log4j</groupId>
+        <artifactId>log4j-1.2-api</artifactId>
+      </dependency>
+      <dependency>
+        <groupId>org.apache.logging.log4j</groupId>
+        <artifactId>log4j-slf4j-impl</artifactId>
       </dependency>
       <dependency>
         <groupId>org.antlr</groupId>