I wanted to know if any ClassNotFoundException
or similar unexpected
exception is raised when one applies the CVE-2021-44228 aka Log4Shell
hotfix as recommended here.
Result: It looks like no exception is bubbling up.
To test this execute the following commands:
./gradlew clean installDist
env JAVA_OPTS=-Xmx64M ./build/install/log4shell-hotfix-side-effect/bin/log4shell-hotfix-side-effect
It will log a bunch of messages and timings and there should be no exceptions.
If the log4j jar file is not patched properly there should be a measurable delay between the messages (or you might even get an RCE, YMMV).