From f04cf16b6664304f7e8e1a7a2b1a309a6e82e100 Mon Sep 17 00:00:00 2001
From: Ceki Gulcu owner. If possible, they should also be monitored
against changes and unauthorized manipulation.
As discussed above, while log4j 2.14 and earlier are - vulnerable to log4shell, log4j 1.x and logback are not.
- -At this stage, it might be useful mention the prevalence of - each logging library in order to put things into - perspective. Here are the relevant figures as found - in mvnrepository site - on 2021-12-17.
- -| Project | -Category | -group:artifact | -usageCount | -percentage | -
|---|---|---|---|---|
| SLF4J | -API | -org.slf4j:slf4j-api | -52,247 | -69% | -
| Commons-logging | -API | -commons-logging:commons-logging | -10,412 | -14% | -
| SLF4J | -API | -org.slf4j:jcl-over-slf4j | -7,546 | -10% | -
| LOG4J2 | -API | -org.apache.logging.log4j:log4j-api | -5,226 | -7% | -
| Total | -API | -- | -75,431 | -100% | -
| Project | -Category | -group:artifact | -usageCount | -percentage | -
|---|---|---|---|---|
| LOGBACK | -implementation | -ch.qos.logback:logback-classic | -21,770 | -48% | -
| LOG4J1 | -implementation | -log4j:log4j | -16,610 | -37% | -
| LOG4J2 | -implementation | -org.apache.logging.log4j:log4j-core | -6,974 | -15% | -
| Total | -implementaion | -- | -45,174 | -100% | -
Notwithstanding its 48% prevalence overall (implementation), - no attacks have been reported against logback that we are aware - of.