title: How can I check if my Java project uses Log4j and which version?
body: <p>Due to the <a href="https://en.wikipedia.org/wiki/Log4Shell" rel="nofollow noreferrer">Log4Shell vulnerability</a> I would like to search and find out if my Java project is implementing Log4j directly or by dependencies, and which version.</p>
  <p>I have, for example, projects with these dependency management tools:</p>
  <ol>
  <li><a href="https://en.wikipedia.org/wiki/Apache_Maven" rel="nofollow noreferrer">Maven</a> project</li>
  <li><a href="https://en.wikipedia.org/wiki/Apache_Ivy" rel="nofollow noreferrer">Apache Ivy</a> project</li>
  <li>Old legacy project without any dependency management</li>
  </ol>
  <p>How can I do this on these types of dependency management tools?</p>
  <p>Details about the vulnerability (including mitigation steps):</p>
  <p><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228" rel="nofollow noreferrer">CVE-2021-44228</a></p>
  <p><a href="https://logging.apache.org/log4j/2.x/security.html" rel="nofollow noreferrer">Apache Log4j Security Vulnerabilities</a></p>