Log4j 1.2.x files found in AAI

Products

• Automation Analytics & Intelligence

Issue/Introduction

Log4j 1.2.x files found in AAI

Environment

Release : 6.x (Including 6.5)

Resolution

AAI has both log4j 1.2.x and 2.x.

 

There have been patches to address critical vulnerabilities with log4j 2.x, these have been included in the latest AAI releases.

 

The log4j 1.x files are however still present in AAI, and will eventually be removed, as there are some requirements of AAI's underlying 3rd party components that still require these files.

 

We do not have an ETA on when this will be completed, but we will update this document when we have more information.