Log4j vulnerability (CVE-2021-44228 and subsequent CVE-2021-45046)

[Sergiy Radyakin]

Thank you James Hassell (StataCorp) for placing a comment regarding the Log4j vulnerability in Stata's FAQ online.
This is very useful.

[Sergiy Radyakin]

Is this the component being affected?
Or the 'portions' didn't include the vulnerable code?

[James Hassell (StataCorp)]

Hi Sergiy Radyakin,

Stata 15 and Stata 16 don't include the Log4j library, but instead include "Apache Commons Logging 1.2" which is not affected by the Log4j vulnerability.

We will get the copyright page edited so that it is accurate and include that in a future update.

[Sergiy Radyakin]

Dear James Hassell (StataCorp) , thank you very much for this clarification. This is very helpful. Happy New Year!! Sergiy