[FIXED] Is Logback also affected by Log4j 0-day vulnerability issue in Spring Boot?

Issue

As I understand it, Logback is written by the same authors. Our apps are using Logback instead. Is there a chance that Logback is also affected by the exploit in Log4j? This is critical for our organisation.

Solution

From the Spring blog:

Spring Boot users are only affected by this vulnerability if they have switched the default logging system to Log4J2. The log4j-to-slf4j and log4j-api jars that we include in spring-boot-starter-logging cannot be exploited on their own. Only applications using log4j-core and including user input in log messages are vulnerable.

Useful explanation points:

log4j-to-slf4j is an adapter between the Log4J API and SLF4J. It brings indeed log4j-api but does not bring log4j-core so our starter is not affected by this vulnerability.

Answered By - Arun Sai