Log4j: The pain just keeps going
Had to deal with some automated scan tool telling a client &quot;you have log4j - you&#x27;re vulnerable!&quot; when... we didn&#x27;t.  A project was including a dependency on SLF4J and <i>that</i> project pulled in slf4j-log4j (IIRC).  But it was not configured, wasn&#x27;t compiled in to the final jar, and ... even it was, it was <i>very old</i> log4j (1.1 or 1.2 IIRC?).  The vulnerability didn&#x27;t affect that older version.<p>We had to spend a week back and forth with<p>&quot;no, we&#x27;re not vulnerable&quot;.<p>&quot;But we see log4j is right there in the a file in the directory&quot;.<p>&quot;No, it&#x27;s not vulnerable and it&#x27;s not being used and we can&#x27;t reasonably fork the entire dependency just to remove that one sub-dependency from our project&#x27;s dependency&quot;<p>&quot;But we see log4j is right there in the a file in the directory&quot;.<p>Also, there was no budget to do any sort of rewrite&#x2F;refactor&#x2F;etc anyway.