5 ms·

What adds to the confusion is that log4j2 rebrands itself as log4j. For example the Log4j2 artifact name is: `org.apache.logging.log4j:log4j-api` but it is actu

What adds to the confusion is that log4j2 rebrands itself as log4j. For example the Log4j2 artifact name is: `org.apache.logging.log4j:log4j-api` but it is actually Log4j2, not the original Log4j. There is plenty of stuff out there that still uses Log4j 1.7, 1.8, etc. I assume this is all about Log4j2? And not about the original Log4j? Or is the original Log4j also affected?

raesene9 5y ago
There are indications (https://twitter.com/dlitchfield/status/1469199750452822017?s=20 https://twitter.com/dlitchfield/status/1469199750452822017?s...) that log4j1 can be affected too...
- testplzignore 5y ago
  That tweet has since been deleted. I haven't seen anything so far to indicate that log4j v1 is affected.
  - Zardoz84 5y ago
    I can't reproduce with log4j 1.2.17
philipwhiuk 5y ago
The original Log4J is EOL and unmaintained. It's not affected by this but it does have other known vulns.