# Log4j vulnerability in dataproc - how to update?

**URL:** <https://discuss.hail.is/t/log4j-vulnerability-in-dataproc-how-to-update/2408>\
**Category:** Hail Batch & General Cloud\
**Created:** [December 15, 2021, 5:12pm UTC](https://discuss.hail.is/t/log4j-vulnerability-in-dataproc-how-to-update/2408 "2021-12-15T17:12:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![heesuallykim](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.hail.is/heesuallykim/32/695_2.png) [@heesuallykim](https://discuss.hail.is/u/heesuallykim)\
**Post date:** [December 15, 2021, 5:12pm UTC](https://discuss.hail.is/t/log4j-vulnerability-in-dataproc-how-to-update/2408/1 "2021-12-15T17:12:37Z")

</div>

In the Google Cloud Console, clusters that I recently created by the standard script e.g.

```auto
hailctl dataproc start [name] --region [region]

```

are showing up as using an image that has log4j vulnerabilities. Is there any way to fix this?

---

<div class="post-metadata">

**Author:** ![danking](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.hail.is/danking/32/43_2.png) [@danking](https://discuss.hail.is/u/danking)\
**Post date:** [December 15, 2021, 7:37pm UTC](https://discuss.hail.is/t/log4j-vulnerability-in-dataproc-how-to-update/2408/2 "2021-12-15T19:37:35Z")

</div>

EDIT: Hail 0.2.80 is now available, please install that to avoid this issue.

* * *

Hey @heesuallykim ,

We’ll be releasing a new hailctl version shortly.

If you absolutely need to fix this now, you can edit the `IMAGE_VERSION` variable in the `hailtop/hailctl/dataproc/start.py` file in your installation of Hail. For example, my Hail is installed in `/Users/dking/miniconda3/lib/python3.7/site-packages`:

```auto
# pip3 show hail
Name: hail
Version: 0.2.79
Summary: Scalable library for exploring and analyzing genomic data.
Home-page: https://hail.is
Author: Hail Team
Author-email: hail@broadinstitute.org
License: UNKNOWN
Location: /Users/dking/miniconda3/lib/python3.7/site-packages
Requires: google-cloud-storage, python-json-logger, nest-asyncio, hurry.filesize, requests, azure-identity, bokeh, numpy, pandas, tqdm, azure-storage-blob, humanize, dill, gcsfs, parsimonious, boto3, google-auth, janus, asyncinit, scipy, aiohttp-session, tabulate, sortedcontainers, orjson, decorator, fsspec, botocore, pyspark, avro, Deprecated, aiohttp, PyJWT
Required-by: benchmark-hail

```

So I can modify

```auto
/Users/dking/miniconda3/lib/python3.7/site-packages/hailtop/hailctl/dataproc/start.py

```

Replacing

```auto
IMAGE_VERSION = '2.0.22-debian10'

```

with

```auto
IMAGE_VERSION = '2.0.25-debian10'

```

---

<div class="post-metadata">

**Author:** ![danking](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.hail.is/danking/32/43_2.png) [@danking](https://discuss.hail.is/u/danking)\
**Post date:** [December 16, 2021, 8:33pm UTC](https://discuss.hail.is/t/log4j-vulnerability-in-dataproc-how-to-update/2408/3 "2021-12-16T20:33:08Z")

</div>

Hail 0.2.80 is now available and addresses the aforementioned log4j vulnerability. We continue to monitor the log4j situation and will release another version of Hail if necessary.

---

<div class="post-metadata">

**Author:** ![danking](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.hail.is/danking/32/43_2.png) [@danking](https://discuss.hail.is/u/danking)\
**Post date:** [December 21, 2021, 4:37pm UTC](https://discuss.hail.is/t/log4j-vulnerability-in-dataproc-how-to-update/2408/4 "2021-12-21T16:37:10Z")

</div>

We’ve released 0.2.81 which addresses the latest round of log4j vulnerabilities.