title: Can Apache HTTP Server allow reverse shelling thanks to the new Log4j vulnerability?
body: <p>I have an Apache HTTP Server installed on a Centos 8 machine, I would like to know if it uses the Log4j library by virtue of the new vulnerability discovered that is compromising many servers on the web. If so, what would be the procedure to resolve? From my analysis I could see from the repository (svn.apache.org/repos/asf/httpd/httpd/) that the language used is C, XML so I imagine that it does not use Log4j for tracking the logs, but projects those relating to active modules.
  Thank you.</p>