Apache Log4j Security Vulnerabilities: What we need to do?

What is Log4j security issue?
What we need to do?

download log4j binary:

git hub log4j :

log4j security explanation:

log4j CVE:

Schedule a meeting in case of any queries/guidance/counselling:

~~~Subscribe to this channel, and press bell icon to get some interesting videos on Selenium and Automation:

Follow me on my Facebook Page:

Let's join our Automation community for some amazing knowledge sharing and group discussion on Telegram:

Naveen AutomationLabs Paid Courses:
GIT Hub Course:

Java & Selenium:

Java & API +POSTMAN + RestAssured + HttpClient:

[SarangHoley]

Thanks Naveen for this quick update, since people are looking out for resolution for it and Now we all having your video as authentic source which can be shared as much as possible to dev and QA. 👍😊

[naveenautomationlabs]

download log4j binary:

git hub log4j :

log4j security explanation:

log4j CVE:

[tarakarajendrachinni]

Thanks Naveen for sharing this in detail. Even, we got a critical issue from customer support recently with critical and dev team updated with 2.15 jars where ever we have been using the log4j jars..

[venkateshsivadurga]

Thanks for explanation on this issue.. today morning I read an article about this but your explanation is very much clear and interesting always. Really thanks Naveen sir :)

[TWINFLAME]

December 14  - UPDATED RECOMMENDATIONS:

The previous patch iteration 2.15.0 does not fully remediate the vulnerability, and thus it is recommended to apply the latest patch (version 2.16.0)


December 14 - UPDATED REFERENCES:

[pravinjadhav]

Great man.. Always you are there with something new and important with detailed explanations.

[praveenreddynarala]

Please use the latest log4j 2.16.0. it got released some time back and it is more secured than 2.15.0.

[madhavigeddam]

Thanks Naveen, I'm using log4j 1.2.17 is it suggested to change to 2.16.0

[pravinshinde]

Thanks Naveen for wonderful explaination
Adding one more point
We can cross check m2 repository to know if any of our project dependency adding log4j affected version jar.
Earlier version of poi is downloading log4j.

[rishabhkumar]

Thanks Naveen for a detailed explanation 👍

[sumanchanda]

Thanks Naveen. But I have one question there are multiple jars which utilizes log4j for their in built function and classes...in that case should we also exclude them in POM

[vishalavishala]

Thanks Naveen, our team is also looking into.

[sukanyaganesan]

Could really understand and apply immediately.thank you

[surojitmoira]

I am using selenium inside that pom we have jxl 2.6.12 which is using log4j 1.2.4. Internally how to modify that ?

[sumedhtayade]

Is Log4j attack more dangerous and harmful than SQL injection attacks?

[hireme]

The problem is using spring boot framework which internally downloads all the dependencies...so how do we get that updated?

[arunkumars]

Thank you for your update.. Log4net have any impact..?

[LoyisoNicholusGawula]

how do you upgrade this to the latest version.. can you please share steps in windows server machine

[venkatmurrhy]

If applications runs in intranet and not expose to public internet..Will it impacts?..Those applications are third party do we need to upgrade log4j version.?

[anmolsarena]

Only changing the pom.xml file will fix this? Or we need to put the latest version of jar file in the Artifactory also?