log4j vulnerability fix
It turns out log4j’s bug is a pretty common one, and it has been fixed by the log4j community since July.
A huge thanks to log4j developers for their quick response in patching this vulnerability.
With the release of 4.x there will be one less option in my console as I go into deep sleep. This is pretty much the first time I’ve had to log into a console that doesn’t have “just to save a few bytes.” I’m so grateful for the log4j community’s quick response to this vulnerability.
log4j is a popular logging framework for Java. It has a very simple API and is very easy to use. It can be used for a wide range of programming (Java, Groovy, and Kotlin) and is used in many projects, including mine. The problem that we encountered with log4j was that some developers did not provide the “log4j-core” dependency when they were bundling it with their own project.
The log4j-core dependency was a little bit harder to find, so we had to search the internet for more information on how to get it. We found a great blog post about using the dependency with Gradle and the build.gradle file of the project.
Thanks to the blog post, we were able to pull it in with the following build.
We are happy to announce that the problem caused by adding the log4j dependency was fixed by the log4j-core dependency in log4j-core.jar and its dependencies: log4j.jar, java.util.logging.Logger, org.apache.commons.logging.Log.
We also discovered that the problem was caused by an incorrect usage of the log4j-core dependency. The log4j-core dependency was configured to use a log4j.xml file that didn’t exist. We found that the log4j-core dependency was configured to use an incorrect log4j-core.xml file. There have been multiple commits that have been made to fix the issue, one of which was made on April 14, 2017.
As we made it clear in our initial vulnerability report, the problem was fixed in April of 2017. We are currently investigating how this problem came to be fixed and we will let you know if we find out the answer.
Log4j is a Java library used to log things, and we’ve had several issues in recent months where the library was configured incorrectly. We are actively working to make the log4j library more secure and we apologize for the inconvenience this is causing.
