Uploaded image for project: 'Log4j 2'
  1. Log4j 2
  2. LOG4J2-3232

Log4j 3.0 - Better Java SE modules dependency

    XMLWordPrintableJSON

Details

    • New Feature
    • Status: Resolved
    • Major
    • Resolution: Duplicate
    • 2.16.0
    • None
    • Core
    • None

    Description

      Due to its legacy pre-Java 9 JPMS era, Log4j 2 Core currently has strong dependencies to 'java.desktop' and 'java.management' modules. Log4j 2 Core breaks and does not work properly without these two modules.

      Module 'java.naming' is referenced but optional for proper runtime operation. The RCE vulnerability reported in December 2021 towards Log4j 2.x can be mitigated in any Java 9+ version as long the runtime had been assembled with jlink and excluding 'java.naming' module.

      As Log4j is reimagined for a 3.0 major new release, it would be recommended to have a Core module that relies solely on 'java.base' and 'java.logging', while separating/publishing different functionalities as separate artifacts/modules, so users can consume them on-demand.

      Attachments

        Activity

          People

            Unassigned Unassigned
            bruno.borges Bruno Borges
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: