Comment by tgv

> There are products (Nexus Firewall) that can check dependencies for vulnerabilities and either block them from entering the network or fail CI pipelines.

Once they're known. I suppose nexus firewall let log4j pass.