3 ms·
It's probably worth refining it to `log4j-core`. `log4j-api` or various bridges like `log4j-to-slf4j` are not affected, but will show up in nearly any spring bo
by isbvhodnvemrwvn 5y ago
It's probably worth refining it to `log4j-core`. `log4j-api` or various bridges like `log4j-to-slf4j` are not affected, but will show up in nearly any spring boot app.
- kerblang 5y agoJust for reference here's the posting that confirms such: https://spring.io/blog/2021/12/10/log4j2-vulnerability-and-spring-boot https://spring.io/blog/2021/12/10/log4j2-vulnerability-and-s... Also worth noting this is not log4j 1, but log4j 2, like angular vs. angularjs. Version 2 is a backwards-incompatible rewrite with a different package structure, effectively a different product. Version 1 is unaffected by this mess.