Vulnerable Log4j version after building.

[Floppaging]

In the screenshot you can see that the log.txt file from "ForgeHax-1.16.5-3.3.1\build\reobfJar\log.txt" shows that forgehax is built using a vulnerable Log4j version, namely "log4j-core-2.11.2.jar"

Source: "https://logging.apache.org/log4j/2.x/security.html"

What do you guys think about this ? Is the version being old not a problem since Forge has "patched" Log4j on its own on newer versions than 36.2.20 (for 1.16.5) ? I personally updated Log4j to a newer version.

[fr1kin]

ForgeHax uses whatever version of Log4J Minecraft and Forge use. There is not much I can do about that, hopefully Forge has dealt with the issue. Also there is a java parameter you can add that will disable the cause of the exploit. I forget what it is though.

[marpisco]

there is a java parameter you can add that will disable the cause of the exploit.

log4j2.formatMsgNoLookups=true or set the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true