[wildfly-dev] Re: wildfly, log4j2 CVE fixes and fix releases
Hi Andrew,
On 26 Jan 2022, at 15:46, Andrew Marlow
<marlow.agents(a)gmail.com> wrote:
Hello Wildflyers,
I see that wildfly 26.0.1 refers to log4j2 version 2.17.1 and this is good due to the
recent kerfuffle with log4j2 CVEs. However, I don't see this being patched back to
earlier wildfly versions. Is there any plan to?
We don’t have plans to patch Log4J in previous releases of WildFly.
I am on wildfly 23 and am using JDK8. There is a plan to eventually
move to JDK11 but it is some way off. Once we're there I expect it'll stay that
way for several years. So I am hesitant in moving to a more recent version of wildfly - I
am not sure what support there is for the older JDKs.
As Brian mentioned in his mail about "WildFly Releases in 2022”, WildFly 26.1 will be
the last version of WildFly to run on Java SE 8 (and EE8). WildFly 27 is targeting Java EE
10 and Java SE 11.
Does that answer your questions?
Best regards,
Jeff
--
Jeff Mesnil
Principal Software Engineer
Red Hat
http://jmesnil.net/