Log4j 2.15.0 – Previously suggested mitigations may not be enough
I must confess to feeling that the reach of this CVE is a bit oversold. Yes, it&#x27;s a terrible RCE and a major catastrophe for anyone using log4j. But log4j hasn&#x27;t been the popular choice for logging implementations in a long time. Libraries typically use facades like slf4j or commons-logging, so the risk of pulling in an active log4j implementation transitively is pretty small. Your application&#x2F;appserver either logs with log4j or not, and your developers are probably aware of this when they configured logging. You shouldn&#x27;t need to pour over code to figure it out.<p>It would be far worse if this exploit existed in slf4j or commons-logging.