Cassandra 4.0 is having log4j-over-slf4j-1.7.25 and CVE-2021-44228 is not applicable. however, slf4j-1.7.25 has CVE-2018-8088. How we are addressing Cassandra's vulnerable log4j issue.
1 Answers
Apache Cassandra uses Logback as the default logger, not Log4j so it is not affected by the vulnerability identified in CVE-2021-44228. Cheers!
Related