Vulnerable to Log4Shell?

[deadlytea]

Is the version of log4j being used by slf4j in the apicurio-registry vulnerable to CVE 2021-44228/Log4Shell??

If so are there plans to address this and update? I am running apicurio-registry in production and am concerned.

I've tried my hand at finding if the version is vulnerable but I must admit my java package management skills are lacking.

[EricWittmann]

All components of Registry are using slf4j and jboss-logging, not log4j. Quarkus (which we run on top of) is not vulnerable - you can read more about that here:

https://quarkus.io/blog/quarkus-and-CVE-2021-4428/

And we do not add log4j in the application layer on top of that. We think it's clear that we are not impacted by the log4j vulnerability.