Is Log4j CVE-2021-44228 a problem here?
You didn't read the forum ?
https://www.traccar.org/forums/topic/traccar-server-affected-by-log4j-security-issue/
With no find function and no refs to CVE-2021-44228 in the first page I didn't noticed. Sorry to steal your life 30 seconds.
Dont worry about it. Here is the find function https://www.traccar.org/search/
Very old versions used to use log4j, but if you are using a more recent one, you should be fine. A bit more info on specific version numbers:
Note for users who are still on older versions: Traccar v3.16 still has log4j v1.2.17. However, log4j versions 1.x are only affected, if the logging config file was specifically modified to perform JDNI lookups. See http://slf4j.org/log4shell.html for details.
Basically no versions of Traccar are affected.
Do you mean that Traccar's logging config by default does not have JNDI enabled?
Correct. We never enable JMSAppender.
As per subject, is there some dependency on Log4j and there is a new build/config suggestion to eliminate the problem?
Thanks