How to verify the current Implementation version of log4j.jar file

Issue

• We would like to verify the implementation version of a log4j.jar file, either to verify the application of an update or to assess current vulnerability. 

Environment

• DXP 7.3, DXP 7.4

Resolution

• You can find the current implementation version of log4j. jar file by: 
  1. Opening the .jar file
  2. Go to /META-INF/
  3. Open the MANIFEST.MF file
  4. Search for "Implementation-Version"
  5. Review the value of Implementation-Version and cross-reference it with the expected log4j version. 

Additional Information

• https://help.liferay.com/hc/en-us/articles/4417225930893-Liferay-s-Statement-about-recent-Log4j-vulnerabilities 
• https://help.liferay.com/hc/en-us/articles/7333153200269-How-to-verify-that-a-Log4j-patch-has-resolved-all-Log4j-vulnerabilities