title: Log4j Vulnerability in 3rd party applications like apache zookeeper
body: <p>Apache log4j zookeeper uses log4j 1.2 which is vulnerable to RCE.
  To rectify this issue we planned to exclude log4j 1.2 and include log4j 2.17.1 core and log4j 2.17.1 api  in the dependency</p>
  <p>It doesnt help. Can somebody please suggest how to exclude jars from third party libraries</p>
  <p><strong>Error:</strong>
  Getting this errror :
  Exception in thread &quot;main&quot; java.lang.NoClassDefFoundError: org/apache/log4j/jmx/HierarchyDynamicMBean
  at org.apache.zookeeper.jmx.ManagedUtil.registerLog4jMBeans(ManagedUtil.java:50)
  at org.apache.zookeeper.server.ZooKeeperServerMain.initializeAndRun(ZooKeeperServerMain.java:91)
  at org.apache.zookeeper.server.ZooKeeperServerMain.main(ZooKeeperServerMain.java:61)
  at org.apache.zookeeper.server.quorum.QuorumPeerMain.initializeAndRun(QuorumPeerMain.java:125)
  at org.apache.zookeeper.server.quorum.QuorumPeerMain.main(QuorumPeerMain.java:79)
  Caused by: java.lang.ClassNotFoundException: org.apache.log4j.jmx.HierarchyDynamicMBean
  at java.net.URLClassLoader.findClass(URLClassLoader.</p>
  <p><strong>We tried this ..</strong></p>
  <pre><code>&lt;dependencies&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.apache.zookeeper&lt;/groupId&gt;
              &lt;artifactId&gt;zookeeper&lt;/artifactId&gt;
              &lt;version&gt;3.5.1-alpha&lt;/version&gt;
              &lt;exclusions&gt;
                  &lt;exclusion&gt;
                      &lt;groupId&gt;log4j&lt;/groupId&gt;
                      &lt;artifactId&gt;log4j&lt;/artifactId&gt;
                  &lt;/exclusion&gt;
              &lt;/exclusions&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.apache.logging.log4j&lt;/groupId&gt;
              &lt;artifactId&gt;log4j-core&lt;/artifactId&gt;
              &lt;version&gt;2.17.1&lt;/version&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.apache.logging.log4j&lt;/groupId&gt;
              &lt;artifactId&gt;log4j-1.2-api&lt;/artifactId&gt;
              &lt;version&gt;2.17.1&lt;/version&gt;
          &lt;/dependency&gt;
      &lt;/dependencies&gt;
  </code></pre>