title: Is neo4j 3.5 impacted by CVE-2021-44228?
body: <p>I found that only neo4j &gt; 4.2 is impacted by this vulnerability (<a href="https://stackoverflow.com/questions/70308545/neo4j-and-cve-2021-44228">here</a> and <a href="https://github.com/neo4j/neo4j/issues/12796" rel="nofollow noreferrer">here</a> )</p>
  <p>But in neo4j 3.5.21 pom I see a dependency to log4j (<a href="https://github.com/neo4j/neo4j/blob/3.5.21/pom.xml" rel="nofollow noreferrer">here</a>):</p>
  <pre><code>&lt;dependency&gt;
          &lt;groupId&gt;log4j&lt;/groupId&gt;
          &lt;artifactId&gt;log4j&lt;/artifactId&gt;
          &lt;version&gt;1.2.17&lt;/version&gt;
  &lt;/dependency&gt;
  </code></pre>
  <p>So is this version really safe for use in production environment right now ?</p>