diff --git a/hadoop-common-project/hadoop-common/CHANGES.txt b/hadoop-common-project/hadoop-common/CHANGES.txt
index 4911152148f..50e8a08d0a2 100644
--- a/hadoop-common-project/hadoop-common/CHANGES.txt
+++ b/hadoop-common-project/hadoop-common/CHANGES.txt
@@ -284,6 +284,8 @@ Branch-2 ( Unreleased changes )
     HADOOP-8620. Add -Drequire.fuse and -Drequire.snappy. (Colin
     Patrick McCabe via eli)
 
+    HADOOP-8687. Upgrade log4j to 1.2.17. (eli)
+
   BUG FIXES
 
     HADOOP-8372. NetUtils.normalizeHostName() incorrectly handles hostname
diff --git a/hadoop-project/pom.xml b/hadoop-project/pom.xml
index e7825c12afc..8398e50a691 100644
--- a/hadoop-project/pom.xml
+++ b/hadoop-project/pom.xml
@@ -458,7 +458,7 @@
       <dependency>
         <groupId>log4j</groupId>
         <artifactId>log4j</artifactId>
-        <version>1.2.15</version>
+        <version>1.2.17</version>
         <exclusions>
           <exclusion>
             <groupId>com.sun.jdmk</groupId>