# Statement about CVE-2021-44228 Log4j vulnerability concerning i-net software products **URL:** \ **Category:** General\ **Created:** [December 11, 2021, 10:10am UTC](https://faq.inetsoftware.de/t/statement-about-cve-2021-44228-log4j-vulnerability-concerning-i-net-software-products/269 "2021-12-11T10:10:56Z")\ **Posts on this page:** 1\ **Showing post:** 3
**Author:** ![GerryWeissbach](https://faq.inetsoftware.de/user_avatar/faq.inetsoftware.de/gerryweissbach/32/90_2.png) [@GerryWeissbach](https://faq.inetsoftware.de/u/GerryWeissbach)\ **Post date:** [December 14, 2021, 4:34pm UTC](https://faq.inetsoftware.de/t/statement-about-cve-2021-44228-log4j-vulnerability-concerning-i-net-software-products/269/3 "2021-12-14T16:34:34Z")
**Update** (2021-12-14) As stated above, log4j `1.2.15` and `1.2.17` were used in earlier versions of our product releases. As per [this statement](https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126) there is a potential issue when embedding earlier i-net Clear Reports or i-net PDFC releases in custom products while using a JMS Adapter implementation. This issue can be mitigated by updating to versions newer or equal `20.10` of respective products since no log4j is present in them anymore. Please note that replacing the embedded log4j `1.x` with a more recent log4j `2.15.0` or newer is not possible due to API incompatibilities. --- _[View the full topic](https://faq.inetsoftware.de/t/statement-about-cve-2021-44228-log4j-vulnerability-concerning-i-net-software-products/269)._