RE: Does Spark 3.1.2/3.2 support log4j 2.17.1+, and how? your target release day for Spark3.3?

[Theodore J Griesenbrock]

Again, sorry to bother you.

 

What is the best option available to ensure we get notified when a new version is released for Apache Spark?  I do not see any RSS feeds, nor do I see any e-mail subscription option for this page:  https://spark.apache.org/news/index.html

 

Please let me know what we can do to ensure we stay up to date with the news.

 

Thanks!

 

-T.J.

 

 

T.J. Griesenbrock

Technical Release Manager

Watson Health

He/Him/His

 

+1 (602) 377-7673 (Text only)
t...@ibm.com
 

IBM

 

 

----- Original message -----
From: "Sean Owen" <sro...@gmail.com>
To: "Juan Liu" <liuj...@cn.ibm.com>
Cc: "Theodore J Griesenbrock" <t...@ibm.com>, "User" <user@spark.apache.org>
Subject: [EXTERNAL] Re: Does Spark 3.1.2/3.2 support log4j 2.17.1+, and how? your target release day for Spark3.3?
Date: Thu, Jan 13, 2022 08:05
 

Yes, Spark does not use the SocketServer mentioned in CVE-2019-17571, however, so is not affected.

3.3.0 would probably be out in a couple months.

 

On Thu, Jan 13, 2022 at 3:14 AM Juan Liu <liuj...@cn.ibm.com> wrote:

We are informed that CVE-2021-4104 is not only problem with Log4J 1.x. There is one more CVE-2019-17571, and as Apache announced EOL in 2015, so Spark 3.3.0 will be very expected. Do you think middle 2022 is a reasonable time for Spark 3.3.0 release?
 

Juan Liu (刘娟) PMP®
Release Management, Watson Health, China Development Lab Email: liuj...@cn.ibm.com Phone: 86-10-82452506

 

 

--------------------------------------------------------------------- To unsubscribe e-mail: user-unsubscr...@spark.apache.org