[AMQ-8475] ActiveMQ uses log4j 1.2.17

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 5.16.3
• Labels: docker logging security-issue
• Assignee: Unassigned
• Reporter: Alexei Yarilovets
• Created: 06/Feb/22 13:18
• Updated: 10/Feb/22 09:42
• Resolved: 07/Feb/22 14:40

Description

ActiveMQ server uses old log4j library with CVEs with critical severity
Tested here:
https://search.maven.org/artifact/org.apache.activemq/activemq-all/5.16.3/jar
ActiveMQ uses log4j 1.2.17