title: How to quickly detect and remove log4j classes from our code base and the base image? "mvn dependency:tree" does not check base image
body: <p>We are building an app based on Red Hat JBoss AMQ 6. We wrap some Java code around the base image to provide extra functionalities which are lacking in AMQ 6.</p>
  <p>Now, when the CVE of Log4j stroke, we found that this component is vulnerable because it uses log4j 1.x. Now I don't just mean our Java code uses it, but also the base image of Red Hat AMQ 6 uses it. As AMQ 6 is EOL now, Red Hat does not provide support anymore, so there will not be official releases with fix.</p>
  <p>So, how do I remove vulnerable log4j 1.x classes from:</p>
  <ul>
  <li>my Java code</li>
  <li>the base image</li>
  </ul>
  <p>?</p>
  <p>I am building with <code>jib</code> maven plugin.</p>
  <p>It seems <code>mvn dependency:tree</code> only gives info about our Java wrapper code, not about the base image. And I don't understand what does the &quot;+&quot; and &quot;-&quot; mean while it gives output like this:</p>
  <pre><code>[INFO] +- org.jboss.resteasy:resteasy-jaxrs:jar:3.7.0.Final:compile
  [INFO] |  +- org.jboss.spec.javax.ws.rs:jboss-jaxrs-api_2.1_spec:jar:1.0.2.Final:compile
  [INFO] |  +- org.jboss.spec.javax.xml.bind:jboss-jaxb-api_2.3_spec:jar:1.0.1.Final:compile
  [INFO] |  +- org.reactivestreams:reactive-streams:jar:1.0.2:compile
  [INFO] |  +- javax.validation:validation-api:jar:2.0.1.Final:compile
  [INFO] |  +- org.jboss.spec.javax.annotation:jboss-annotations-api_1.3_spec:jar:1.0.1.Final:compile
  [INFO] |  +- javax.activation:activation:jar:1.1.1:compile
  [INFO] |  +- org.apache.httpcomponents:httpclient:jar:4.5.4:compile
  [INFO] |  |  +- org.apache.httpcomponents:httpcore:jar:4.4.7:compile
  [INFO] |  |  +- commons-logging:commons-logging:jar:1.2:compile
  [INFO] |  |  \- commons-codec:commons-codec:jar:1.10:compile
  [INFO] |  +- commons-io:commons-io:jar:2.5:compile
  [INFO] |  +- net.jcip:jcip-annotations:jar:1.0:compile
  [INFO] |  \- org.jboss.logging:jboss-logging:jar:3.3.2.Final:compile
  </code></pre>
  <p>Does <code>+</code> mean that it can be expanded further but is not shown here?</p>
  <p>Some background here: <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-44228" rel="nofollow noreferrer">https://nvd.nist.gov/vuln/detail/CVE-2021-44228</a></p>