Log4j-1.2.15.jar seems to be included in the SoapUI-5.7.0 instalation package

SmartBear / soapui

SoapUI is a free and open source cross-platform functional testing solution for APIs and web services.

http://www.soapui.org

Other

1.56k stars 607 forks source link

Log4j-1.2.15.jar seems to be included in the SoapUI-5.7.0 instalation package #750

Open tapalif opened 2 years ago

tapalif commented 2 years ago

Our vulnerability scanner has identified, after installing SoapUI using the associated Linux installation package that log45-1.2.15.jar is installed under the following directory:

/opt/SmartBear/SoapUI-5.7.0/hermesJMS/lib/log4j-1.2.15.jar

is this being used by SOAPUI (the pom file suggests it isnt) ? if not can this be removed from the installation package