How to fix neo4j log4j issues

[luckyyun]

안녕하세요. 오랜만에 커뮤니티에 질문합니다.
neo4j 4.2.11은 log4j 보안이슈 관련해서 조치방법에 대해 공식가이드를 전달해주지 않나요?
4.2.X 엔터프라이즈 버전을 사용하고 있는데(우분투 os) log4j 보안이슈해결방법에 대해 아시는분이 있다면 상세하게 알려주시면 감사하겠습니다.
[Google translation]
Hello. It's been a while since I asked the community.
Isn't neo4j 4.2.11 an official guide on how to deal with log4j security issues?
I am using the 4.2.X enterprise version (Ubuntu os), and if anyone knows how to solve the log4j security issue, please let me know in detail.

[koji]

Hi @luckyyun

This post is helpful.

Log4J CVE Mitigation for Neo4j

Log4J CVE Mitigation for Neo4j Announcements

Hi Everyone, We are writing to alert you of a potential vulnerability issue - CVE-2021-44228 The issue impacts Neo4j version 4.2+. Versions 4.0 and 4.1 use slf4j-log4j12 and are not impacted. Version 4.2 introduces using log4j2 We are working on a fix in 4.2 and up (Neo4j versions 4.3 and 4.4), Meanwhile please use the configuration setting in your $PATH_TO_NEO4J/conf/neo4j.conf or /etc/neo4j/neo4j.conf. (That is also the case for Neo4j Desktop) dbms.jvm.additional=-Dlog4j2.formatMsgN…

Until the official version upgrade, I modified neo4j.conf to fix this.

[luckyyun]

안녕하세요 .Koji님

보내주신 URL의 내용을보내주시기 전에 저는 이 글을 먼저 읽고log4j 조치를 했습니다.

그러나 log4j 2.14 버전을 그대로 사용해야되는지 의문입니다.

제 커뮤니티글에 관심가져주셔서 감사합니다.

[Google translation]

Hello, Koji

Before sending the content of the URL you sent, I read this article first and took action on log4j.

But I wonder if I should use the log4j version 2.14 as is.

Thank you for your interest in my community posts.

[lia_tasoudi]

If using neo4j version 4.1.11 according to the announcement it uses an unaffected version of log4j neo4j/pom.xml at 4.1.11 · neo4j/neo4j · GitHub.

How can I confirm that is the case in the docker image 4.1.11-enterprise? Where would I look for the version of that dependency?