# Log4j security issue
**URL:** https://forum.payara.fish/t/log4j-security-issue/169
**Category:** Announcements
**Tags:** security
**Created:** [December 10, 2021, 1:44pm UTC](https://forum.payara.fish/t/log4j-security-issue/169 "2021-12-10T13:44:15Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Marketing](https://forum.payara.fish/u/Marketing)
#### Post date: [December 10, 2021, 1:44pm UTC](https://forum.payara.fish/t/log4j-security-issue/169/1 "2021-12-10T13:44:15Z")
Payara products don’t use the Log4j library directly, but if your application is using it, we recommend that you upgrade to the latest version of Log4J especially when running on a vulnerable JDK version. See [Log4Shell: RCE 0-day exploit found in log4j 2, a popular Java logging package | LunaSec](https://www.lunasec.io/docs/blog/log4j-zero-day/)
---
### Author:  [@mohammed](https://forum.payara.fish/u/mohammed)
#### Post date: [January 4, 2022, 11:28am UTC](https://forum.payara.fish/t/log4j-security-issue/169/2 "2022-01-04T11:28:48Z")
But what I can see in logging.properties files which is located under (payara-5.2021.10\payara5\glassfish\domains\domain1\config) folder is pointing to log4j logger
**(log4j.logger.org.hibernate.validator.util.Version=warn)**
What I can see that payara internally uses log4j logger for the above hibernate validator util version, Could you please confirm is payara is not affected with log4j with the above property turned on.
It will be great if you provide some clarity on this.
---
### Author:  [@Marketing](https://forum.payara.fish/u/Marketing)
#### Post date: [January 6, 2022, 2:15pm UTC](https://forum.payara.fish/t/log4j-security-issue/169/3 "2022-01-06T14:15:37Z")
The short answer is no, Payara is not affected with that property turned on.
" Log4j 2 is only a **test** dependency of Hibernate Validator (being a test dependency, Log4j 2 doesn’t come in your apps through Hibernate Validator so you don’t have to worry about this issue from the Hibernate Validator perspective)"
Their new releases fix the issue of Hibernate Validator being flagged as a false positive.
[Hibernate Validator 6.2.1.Final and 7.0.2.Final released - In Relation To](https://in.relation.to/2021/12/14/hibernate-validator-702-621-final-released/)
---
### Author:  [@luisdanielmesa](https://forum.payara.fish/u/luisdanielmesa)
#### Post date: [July 13, 2022, 9:27pm UTC](https://forum.payara.fish/t/log4j-security-issue/169/4 "2022-07-13T21:27:18Z")
Hi, I’m testing payara micro and ran a scan on the container image to look for vulnerabilities.
I found 3 hits:
- [GHSA-v57x-gxfj-484q regarding com.hazelcast:hazelcast](https://github.com/hazelcast/hazelcast/security/advisories/GHSA-v57x-gxfj-484q)
- CVE-2022-2068 regarding OpenSSL
- [CVE-2021-31684 regarding net.minidev:json-smart](https://nvd.nist.gov/vuln/detail/CVE-2021-31684)
I patched the payara micro image to have a version of OpenSSL that is not affected, but I cannot figure out how to replace the affected libraries. Is there a way to replace libraries in Payara Micro or to compile it from source with replaced libraries? Thanks.
---
### Author:  [@JamesHillyard](https://forum.payara.fish/u/JamesHillyard)
#### Post date: [July 15, 2022, 2:10pm UTC](https://forum.payara.fish/t/log4j-security-issue/169/5 "2022-07-15T14:10:28Z")
Hi @luisdanielmesa,
**Thank you for sharing these concerns, this matter is being handled privately via the formal channels**
As Payara is open source, the source code is available over on GitHub here for you to compile from source and change the libraries as you wish: [Payara](https://github.com/payara/Payara)
Instructions on how to build Payara Micro can be found within our technical documentation here [Overview :: Payara Community Documentation](https://docs.payara.fish/community/docs/General%20Info/Build%20Instructions.html).
Thanks,
James
---
### Author:  [@luisdanielmesa](https://forum.payara.fish/u/luisdanielmesa)
#### Post date: [July 15, 2022, 6:42pm UTC](https://forum.payara.fish/t/log4j-security-issue/169/6 "2022-07-15T18:42:02Z")
Thank you very much @JamesHillyard . If I fix it, can I create a PR so you guys can check it and perhaps integrate it for others to use or is the process internal still? Thanks again.
---
### Author:  [@JamesHillyard](https://forum.payara.fish/u/JamesHillyard)
#### Post date: [July 18, 2022, 8:11am UTC](https://forum.payara.fish/t/log4j-security-issue/169/7 "2022-07-18T08:11:09Z")
Hi @luisdanielmesa,
Absolutely! We always encourage community contributions, if you raise a PR the development team will gladly review the changes.
Thanks,
James