Hi @augi,

Thank you for your contribution! We really value the time you've taken to put this together.

Before we proceed with reviewing this pull request, please sign the Lightbend Contributors License Agreement:

https://www.lightbend.com/contribute/cla

The 2.15.0 version is still vulnerable.

Are you sure? I dont see anything in https://logging.apache.org/log4j/2.x/changes-report.html#a2.16.0 that suggests that...

@augi Thanks for the contribution.

The 2.15.0 version is still vulnerable.

Could you clarify this statement please? https://lists.apache.org/thread/d6v4r6nosxysyq9rvnr779336yf0woz4 says that it's more hardened but it doesn't say that 2.15.0 is "vulnerable" in the same way the 2.x releases prior to 2.15.0 was.

Hello, quoting from this ticket:

Dealing with CVE-2021-44228 has shown the JNDI has significant security issues. While we have mitigated what we are aware of it would be safer for users to completely disable it by default, especially since the large majority are unlikely to be using it.

So they decided to remove default JDNI support by default as it has significant security issue.

Thanks. Looks like https://logging.apache.org/log4j/2.x/security.html says

CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack.

Waiting the new release... finishing this endless log4j curse.

Has this been deployed? I have been using version 1.5.6 but still, it is fetching the 2.15.0 log4j version.

The update to 2.16.0 is released in 1.5.7.

The update to 2.16.0 is released in 1.5.7.

Okay and Thanks