diff --git a/slf4j-site/src/site/pages/log4shell.html b/slf4j-site/src/site/pages/log4shell.html index 059f2573..f848df11 100644 --- a/slf4j-site/src/site/pages/log4shell.html +++ b/slf4j-site/src/site/pages/log4shell.html @@ -51,16 +51,28 @@
As log4j 1.x does not offer a look-up mechanism, it does not suffer from CVE-2021-44228 in any shape - or form.
+ or form. However, note that log4j 1.x is no longer being + maintained. Thus, we definitely urge you to migrate to one of + its successors such as SLF4J and logback. Do migrate without + delaying too much! -As log4j version 1.x is still very widely deployed, we have - been receiving a steady stream of questions regarding the - vulnerability of log4j version 1.x. +
Given that log4j version 1.x is still very widely deployed, + we have been receiving a steady stream of questions regarding + the vulnerability of log4j version 1.x. -
As log4j 1.x does not offer a look up mechanism, it does not - suffer from CVE-2021-44228 in any shape or form. Any innuendo - claiming otherwise is false.
+As log4j 1.x does not offer a look up mechanism, it does + not suffer from CVE-2021-44228 in any shape or form. Any + innuendo claiming otherwise is false.
+ +Having said this, log4j 1.x is no longer being maintained + with all the entailed security implications. Thus, we definitely + urge you to migrate to one of its successors such as + SLF4J/logback, sooner rather than later. But do migrate + without waiting for months! Also note that tools exist to automate the + migration.
+However, as mentioned previously, log4j 1.x is safe. Thus, if - your SLF4J provider/binding is slf4j-logj12.jar, you - are safe.
+However, as mentioned previously, log4j 1.x is safe with + respect to CVE-2021-44228. Thus, if your SLF4J provider/binding + is slf4j-logj12.jar, you are safe regarding + CVE-2021-44228.
If you are using log4j-over-slf4j.jar with SLF4J API, you are safe unless the underlying implementation is log4j @@ -91,7 +104,8 @@ are fine. Otherwise, either remove the said artifact or upgrade to a log4j 2.x version which fixes the issue.
- + +