can we upgrade log4j in j2ee application

[swaroop1958233]

i am using JBOSS sever and i wanted to upgrade log4j. Can we upgrade the existing log4j

[Asutosh_Jena_]

Hi @swaroop1958233 

You should be able to mitigate it by following the below article:

https://helpx.adobe.com/experience-manager/kb/aem-forms-vulnerability-cve-2021-44228.html?wcmmode=di...

https://logging.apache.org/log4j/2.x/security.html

Thanks!

[stephens7886327 · Accepted solution]

You can also quickly update the 2 log4j-core files and remove the class and restart if you have a patch schedule that takes longer to implement

zip -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class