Had to deal with some automated scan tool telling a client "you have log4j - you're vulnerable!" when... we didn't. A project was including a dependency on SLF4J and
that project pulled in slf4j-log4j (IIRC). But it was not configured, wasn't compiled in to the final jar, and ... even it was, it was
very old log4j (1.1 or 1.2 IIRC?). The vulnerability didn't affect that older version.
We had to spend a week back and forth with
"no, we're not vulnerable".
"But we see log4j is right there in the a file in the directory".
"No, it's not vulnerable and it's not being used and we can't reasonably fork the entire dependency just to remove that one sub-dependency from our project's dependency"
"But we see log4j is right there in the a file in the directory".
Also, there was no budget to do any sort of rewrite/refactor/etc anyway.
We had to spend a week back and forth with
"no, we're not vulnerable".
"But we see log4j is right there in the a file in the directory".
"No, it's not vulnerable and it's not being used and we can't reasonably fork the entire dependency just to remove that one sub-dependency from our project's dependency"
"But we see log4j is right there in the a file in the directory".
Also, there was no budget to do any sort of rewrite/refactor/etc anyway.