Log4J Library Version Upgrade for Security Reasons

[pogospike]

hi, our security team has flagged that log4j library version that is bundled with Smartfox requires to be updated because of Vulnerabilities and that it is end of life. Is there any plan to update version of the library?

https://nvd.nist.gov/vuln/detail/CVE-2022-23302

Thanks!

[Lapo]

Hi,
the vulnerability linked here refers to a specific component (JMSSink) which is not configured or activated by SmartFoxServer, therefore it has no impact on SmartFoxServer's security.

Cheers

[pogospike]

Okay thanks for the reply!

But, is there a plan to upgrade the library as it is pretty old now and end of life.

[Lapo]

Not at the moment.

Cheers