# Dealing with the Critical Log4j Vulnerability

DevFeed: [Dealing with the Critical Log4j Vulnerability](<https://devfeed.tech/articles/dealing-with-the-critical-log4j-vulnerability-24668.md>)

Original publisher: [Read original article](<https://blog.gradle.org/log4j-vulnerability>)

Author: Kyle Moore

Published: 2021-12-13T05:00:00Z

Content type: tutorial

Language: en

Sources: [The Gradle Blog](<https://devfeed.tech/sources/the-gradle-blog.md>)

Topics: [log4j](<https://devfeed.tech/topics/log4j.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [CVE-2021-44228](<https://devfeed.tech/topics/cve-2021-44228.md>), [Gradle](<https://devfeed.tech/topics/gradle.md>), [Logging](<https://devfeed.tech/topics/logging.md>)

Tags: [apache](<https://devfeed.tech/tags/apache.md>), [cve-2021-44228](<https://devfeed.tech/tags/cve-2021-44228.md>), [gradle](<https://devfeed.tech/tags/gradle.md>), [log4j](<https://devfeed.tech/tags/log4j.md>), [logging](<https://devfeed.tech/tags/logging.md>), [remote-code-execution](<https://devfeed.tech/tags/remote-code-execution.md>), [upgrade](<https://devfeed.tech/tags/upgrade.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

This advisory explains the critical remote code execution vulnerability in Apache Log4j, identifies affected versions, and provides Gradle users with steps to detect vulnerable dependencies, upgrade Log4j, and protect project and build dependencies. It also clarifies that the Gradle Build Tool itself does not use Log4j.

## Source excerpt

A critical remote code execution (RCE) vulnerability has been identified in the popular Apache Log4j logging library that affects versions 2.0 up to and including 2.14.1. This vulnerability has affected a very large number of JVM-based systems. For more information on the vulnerability itself, see CVE-2021-44228. Update (December 22, 2021): Since the first post, two other vulnerabilities have been identified - CVE-2021-45046 and CVE-2021-45105 - so make sure to go over the different sections for updated instructions. This vulnerability is being actively exploited. All Gradle users should assess whether their software projects are vulnerable and, if necessary, update to Log4j 2.17.0 or newer as soon as possible. We have provided instructions below on how to identify and prevent this vulnerability in your project. We strongly recommended that you configure your Gradle build to reject any vulnerable version of Log4j using a dependency constraint. In addition to your project dependencies, we also recommend protecting your build dependencies as documented below. Note that the Gradle Build Tool itself is not impacted by this vulnerability as it does not use Log4j. Gradle uses SLF4J and a custom logging implementation not susceptible to the vulnerable string substitution. The Gradle Scala plugin uses the Zinc Scala compiler that has a dependency on a vulnerable version of Log4j. However, in this case Gradle also supplies its own logging implementation and Log4j is not used by default. Updates to this post: Updated on December 14th Updated on December 15th Updated on December 22nd Updated on December 30th Protecting your project dependencies 1. Identify if your project uses a vulnerable Log4j version First, verify if your project uses the vulnerable Log4j version using the dependencies report or a Build Scan™. See viewing and debugging dependencies for details. All versions of org.apache.logging.log4j:log4j-core between 2.0 and 2.16.0 (inclusive) are vulnerable. 2. Upgrade