DMCC API and log4j 1.2

[amulm]

Hi,
I'm using the 10.2 version of the DMCC API to run some automated tests on one of our java apps. It appears that one of the DMCC classes we use is referencing Log4j 1.x. This is being flagged by vulnerability scanning software and does not allow us to push the code to production.

Does anyone know of a way around this?

Thanks for any help you may have.

[jtb1]

It would be helpful to know which class (es) are beign flagged - if the scanner is providing that level of detail - or at a minimum what scanning software is being used. My understanding is Avaya does scan for this class of issue so its presence is 1) surprising and 2) needs addressed in some way.

[amulm]

thank you for that very quick reply.

If I remove the latest version of log4j (1.2.17) from my dependencies I'll get a java.lang.NoClassDefFoundError exception. Log4j 1.2 has beed deprecated for some time and replaced with log4j-core, adding this dependency does not make a difference. The one example of a class that is appears to be using log4j1 is com.avaya.mvap.svcproxy.prov.

[jtb1]

Any chance you can sub in the 10.1 version of DMCC API and see if the vulnerability scanner complains? I want to know if this was a goof in the build or a standing issue.
And just to be sure we are talking the DMCC Java SDK here 10.2.0 version, Right?

[flynn1]

According to the bug tracker, DMCC SDK moved to Log4j2 two years ago. Can you tell me what class is still using log4j1.2?