Log4j Files in Microsoft SQL Server 2019 Installations

Log4j files might be present in SQL Server 2019 installations.

Symptoms

The following log4j files were detected in SQL Server 2019 install path:

• C:\Program Files\Microsoft SQL Server\150\DTS\Extensions\Common\Jars\log4j-1.2.17
• C:\Program Files\Microsoft SQL Server\150\DTS\Extensions\Common\Jars\slf4j-api-1.7.5
• C:\Program Files\Microsoft SQL Server\150\DTS\Extensions\Common\Jars\slf4j-log4j12-1.7.5

Because the Commvault software includes the SQL Server 2019 package by default, these vulnerable files might be present even after you install the most recent maintenance release.

Resolution

You can manually delete these files from your computer. The log4j files in the SQL Server 2019 install path are not used by the Commvault software.