Just for reference here's the posting that confirms such: https://spring.io/blog/2021/12/10/log4j2-vulnerability-and-spring-boot https://spring.io/blog/2021/12

Just for reference here's the posting that confirms such: https://spring.io/blog/2021/12/10/log4j2-vulnerability-and-spring-boot https://spring.io/blog/2021/12/10/log4j2-vulnerability-and-s... Also worth noting this is not log4j 1, but log4j 2, like angular vs. angularjs. Version 2 is a backwards-incompatible rewrite with a different package structure, effectively a different product. Version 1 is unaffected by this mess.