3 ms·
Really should run `mvn dependency:tree | grep log4j`
by vips7L 5y ago
Really should run `mvn dependency:tree | grep log4j`
- zorr 5y agoand if it's a gradle project `gradle -q dependencies | grep log4j`.
- krzyk 5y agoSome libs might shade log4j. You need to look for JndiLookup.class in all jars.
- shartte 5y agoYou can disregard a combination of log4j-api+log4j-over-slf4j (as is used by default by Spring Boot) since the actual vulnerability is not in the Log4j2 API, but rather in the actual logging implementation. So forwarding of the Log4j2 API via slf4j to logback is unaffected.