ARROW-1240: [JAVA] security: upgrade logback to address CVE-2017-5929 (take 2)

[mattdarwin]

sorry, this was still not fixed properly. logback version is separately specified in 2 places.

Fixed properly this time.

[wesm]

Can you change the PR title to start with ARROW-1240:? What are the impacts of this patch, because we have a 0.6.0 RC out. Do we need to cancel the RC?

[mattdarwin]

The impact of not including the patch is that we are potentially vulnerable to the "rather severe serialization vulnerability in SocketServer and ServerSocketReceiver". I'm not sure how big the exposure is, but I think it would be prudent to include this in 0.6.0, given that we are aware of it.

The impact of the change itself is none - everything should still work as before.

[wesm]

Right, but we would have to delay the release by several days, which has a concrete cost to languages other than Java. I would personally rather release 0.6.1 with the dependencies fixed than cancel the 0.6.0 RC (unless the vote fails for other reasons). If you feel strongly, please vote accordingly on the mailing list and we can discuss there.

[wesm]

+1. I had to cancel the RC for other reasons, so merging this. Thanks @mattdarwin!