diff --git a/slf4j-site/src/site/pages/log4shell.html b/slf4j-site/src/site/pages/log4shell.html index 059f2573..f848df11 100644 --- a/slf4j-site/src/site/pages/log4shell.html +++ b/slf4j-site/src/site/pages/log4shell.html @@ -51,16 +51,28 @@

As log4j 1.x does not offer a look-up mechanism, it does not suffer from CVE-2021-44228 in any shape - or form.

+ or form. However, note that log4j 1.x is no longer being + maintained. Thus, we definitely urge you to migrate to one of + its successors such as SLF4J and logback. Do migrate without + delaying too much!

-

As log4j version 1.x is still very widely deployed, we have - been receiving a steady stream of questions regarding the - vulnerability of log4j version 1.x. +

Given that log4j version 1.x is still very widely deployed, + we have been receiving a steady stream of questions regarding + the vulnerability of log4j version 1.x. -

As log4j 1.x does not offer a look up mechanism, it does not - suffer from CVE-2021-44228 in any shape or form. Any innuendo - claiming otherwise is false.

+

As log4j 1.x does not offer a look up mechanism, it does + not suffer from CVE-2021-44228 in any shape or form. Any + innuendo claiming otherwise is false.

+ +

Having said this, log4j 1.x is no longer being maintained + with all the entailed security implications. Thus, we definitely + urge you to migrate to one of its successors such as + SLF4J/logback, sooner rather than later. But do migrate + without waiting for months! Also note that tools exist to automate the + migration.

+

How about the SLF4J API?

@@ -70,9 +82,10 @@ mitigate the vulnerability.

-

However, as mentioned previously, log4j 1.x is safe. Thus, if - your SLF4J provider/binding is slf4j-logj12.jar, you - are safe.

+

However, as mentioned previously, log4j 1.x is safe with + respect to CVE-2021-44228. Thus, if your SLF4J provider/binding + is slf4j-logj12.jar, you are safe regarding + CVE-2021-44228.

If you are using log4j-over-slf4j.jar with SLF4J API, you are safe unless the underlying implementation is log4j @@ -91,7 +104,8 @@ are fine. Otherwise, either remove the said artifact or upgrade to a log4j 2.x version which fixes the issue.

- + +

Further reading