💬 [DISCUSSION] Log4j 1.x still in use - security risk assessment needed

[github-actions]

Context

We're still using Log4j 1.x (version 1.2.17) which has been EOL since 2015.

While this is NOT the same as the Log4Shell vulnerability (CVE-2021-44228, which affected Log4j 2.x), it still has known CVEs and receives no security patches:

• CVE-2019-17571 (deserialization in SocketServer)
• CVE-2022-23302 (JMSSink)
• CVE-2022-23305 (JDBCAppender SQL injection)
• CVE-2022-23307 (Chainsaw deserialization)

Questions

1. Should we prioritize migrating to Logback/SLF4J?
2. Are we using any of the vulnerable components?
3. What's the migration effort?

This was supposed to be done in 2022 (see task in backlog).

Files Affected

• pom.xml (log4j dependency)
• All files using log4j imports

[github-actions]

🎯 Triage report

Log4j 1.x (1.2.17, EOL since 2015) is in use with multiple known CVEs: CVE-2019-17571 (SocketServer deserialization), CVE-2022-23302 (JMSSink), CVE-2022-23305 (JDBCAppender SQL injection), CVE-2022-23307 (Chainsaw deserialization). The issue asks whether to migrate to Logback/SLF4J and whether the vulnerable components are active.

📊 Assessment

Dimension	Value	Reasoning
Type	Task	Security assessment and migration planning task.
Labels	question	Seeking team decision on migration strategy.
Coding agent	Needs more info	Needs a risk assessment of which CVEs are exploitable in the current configuration before a migration plan can be scoped.

💡 Notes and suggestions

First step: determine if the vulnerable appenders (SocketServer, JMSSink, JDBCAppender, Chainsaw) are configured in log4j.properties or log4j.xml. If not configured, the CVEs may not be exploitable in practice. Recommended migration path: SLF4J + Logback (Spring Boot's default) — replace log4j:log4j with slf4j-api + logback-classic, update all import org.apache.log4j.* to import org.slf4j.*. Run mvn dependency:tree to ensure Log4j 1.x is fully excluded.

Generated by Daily Issue Triage · 95.1 AIC · ⌖ 18.2 AIC · ⊞ 5.4K · ◷

Add this agentic workflows to your repo

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/daily-issue-triage.md@1c6668b751c51af8571f01204ceffb19362e0f66