We heard that log4j-core.jar is vulnerable.
We noticed that spring-cloud-starter-sleuth (version 2.2.2.RELEASE) dependency brings a dependency which uses log4j-core.jar (version 2.13.0) with provided scope as followed:
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>${log4j.version}</version>
<scope>provided</scope>
</dependency>
The exact jar that brings the log4j dependency is:
<groupId>io.zipkin.brave</groupId>
<artifactId>brave-context-log4j2</artifactId>
<version>5.10.1</version>
We are not using Zipkin in our code or configurations, just Sleuth.
Is our code vulnerable?
Spring Cloud Sleuth 2.x is not supported anymore and as M. Deinum mentioned Sleuth will not bring these dependencies for you because of the provided scope. You can test this by running gradlew dependencies or mvn dependency:tree.