log4j 2.15.0 vulnerability and Ready API 3.10.2
Hi. Another log4j post... since previous topics have been closed with a solution that refers to this communication: https://smartbear.com/security/cve-2021-44228/
Just wanted to point out that the current fix provided in readyAPI 3.10.2, which updated the log4j version to 2.15.0, still can be "susceptible to exploitation in non-default configurations that utilize the ThreadContext class with user-supplied input" (see below source).
I felt compelled to mention this as I indicated in the first post (https://community.smartbear.com/t5/ReadyAPI-Questions/Is-readyapi-3-10-1-affected-by-log4j-security-vulnerability/m-p/227374#M55162) on this subject that "upgrading to 2.15.0 would be recommended". It seems that that info got outdated later during the day...