Spring Boot Log4J vulnerability Solution (2024)

We'll show you how to find the Log4j version to see if it's vulnerable or not.

Because most applications use the Spring Boot framework, we can use the steps below to determine the Log4j version used across multiple components.

1. Spring Boot version

   • Build with Maven: To determine the spring boot version and its dependencies jars, look for the pom.xml file.
   • Gradle build: Look for the dependencies.gradle file to determine the spring boot version and the jars that it depends on.

2. spring-boot-starter version

   Find the spring-boot-starter jar version once we have determined the spring boot version.

   Remember that spring-boot-starter is the Spring Boot framework's core starter engine, which has auto-configuration support, logging and YAML.

3. Log4J version

   It should be simple to determine the Log4J version used in spring-boot-starter from the maven repo link of Spring Boot Starter library https://mvnrepository.com/artifact/org.springframework.boot/spring-boot-starter

   It will help us to verify which log4j version is getting utilized internally in spring-boot-starter.

4. Evaluate Log4J versions that may be affected.

   Your module component is vulnerable if it uses a Log4J version between 2.0-beta-9 and 2.14.1.