Podium and Log4j(2) vulnerability ?

[rtnieuwboer]

Is Podium vulnerable for the Log4j(2) vulnerability ?

Thanks.

[gijskant]

Hi René,

Sorry for my late reply, I somehow did not get a notification of this issue being opened.
Earlier versions of Podium did use log4j, but the latest releases use logback (a log4j alternative).
Initially we did receive a notification about Podium being vulnerable, but that was bases on the log4j-api dependency (which is in Podium). The vulnerability is in log4j-core (not in Podium). See: https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2314719.

Kind regards,
Gijs