log4j exclusion - Maven

[Absh Van]

We have removed log4j version 1.2.17 dependency from the pom.xml file while generating the war we still see the log4j dependency in the war file.

We are using slf4j-log4j12 version 1.2.37 for logger. We ran the maven dependency tree and found the transient dependency.

We have used the exclusion to remove the log4j dependency but still the log4j getting added in the war file.

Attached the dependency for your reference.

<dependency>
	<groupId>org.slf4j</groupId>
	<artifactId>slf4j-log4j12</artifactId>
	<version>1.7.30</version>
	<exclusions>
		<exclusion>
			<groupId>log4j</groupId>
			<artifactId>log4j</artifactId>
		</exclusion>
	</exclusions>
</dependency>

Maven dependency tree

+- org.slf4j:slf4j-log4j12:jar:1.7.30:compile
   \- log4j:log4j:jar:1.2.7.30:compile
+- org.slf4j:slf4j-api:jar:1.7.30:compile

Please help how to remove the log4j dependency.

[Eduardo Bueno]

That is log4j 1.2. It was not affected by the vulnerability. Only Log4j version 2 is affected.

[Rob Spoor]

Eduardo Bueno wrote:That is log4j 1.2. It was not affected by the vulnerability. Only Log4j version 2 is affected.

True, but Log4J 1 has been EOL for years already, and has its own vulnerabilities. I think that you're still safe as long as you don't use a JMS or SMTP appender.

Anyways, slf4j-log4j12 has only one simple task - provide an SLF4J implementation backed by Log4J 1. If you don't want to include Log4J 1, excluding it from slf4j-log4j12 is not the way to go. That's just NoClassDefFoundErrors waiting to happen. Instead, just remove the entire slf4j-log4j12 dependency. I'd replace it with another implementation, like logback-classic or slf4j-jdk14, otherwise you won't have any logging at all.