How can we update the Log4j 1.x version to Log4j 2.x on window Host?

Question

Log4j installed by default during installation of SQL 2017 & it's found at C:\Program Files\Microsoft SQL Server\150\DTS\Extensions\Common\Jars\log4j-1.2.17.jar location.

Installed version : 1.2.17

According to its self-reported version number, the installation of Apache Log4j on the remote host is no longer supported. Log4j reached its end of life prior to 2016.

Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

Answer 1

Hi @Sawant, Pritesh

Microsoft has published information on this issue, which you can refer to this document: https://msrc.microsoft.com/blog/2021/12/microsofts-response-to-cve-2021-44228-apache-log4j2/

But updating Log4j is not directly related to Microsoft, but to Apache, and you can get more information from the Apache site: https://logging.apache.org/log4j/2.x/

For more details, you can refer to this link: https://learn.microsoft.com/en-us/answers/questions/707615/updating-apache-log4j-on-sql-2019-installations.

Best regards,

Aniya

Answer 2

This might help as well:
https://learn.microsoft.com/en-us/microsoft-365/security/defender-vulnerability-management/tvm-manage-log4shell-guidance?view=o365-worldwide