title: How to mitigate Apache Log4j Deserialization RCE (CVE-2019-17571)
body: <p>I have upgraded my log4j-core dependency to 2.15.0 in order to prevent any potential Log4Shell attack. That being said I could not upgrade slf4j-log4j12's indirect log4j dependency from 1.2.17 since the latest stable version of slf4j-log4j12 is still dependent on log4j 1.2.17. This still leaves my webapp vulnerable to <a href="https://www.cvedetails.com/cve/CVE-2019-17571/" rel="noreferrer">CVE-2019-17571</a> if I am not mistaken. So reading about possible mitigation strategies I came across this <a href="https://nsfocusglobal.com/apache-log4j-deserialization-remote-code-execution-cve-2019-17571-vulnerability-threat-alert/" rel="noreferrer">article</a> which recommends to :</p>
  <blockquote>
  <p>prevent the socket port enabled by the SocketServer class in Log4j
  from being opened to the public network</p>
  </blockquote>
  <p>Could anyone please explain to me how can this be achieved and whether would this workaround be sufficient?</p>