Log4J Version used by Gitblit

[Micha0123]

Hi,
is there a way to change the log4j version gitblit uses? it-sec wants me to disable all outdated log4j-versions

[flaix]

You should actually be able to replace the used log4j with a current version of reload4j. Gitblit comes with its dependencies JARs in a directory, so that it is possible to easily replace them.

In your installation find the ext folder.
Then replace the three files
log4j-1.2.17.jar
slf4j-api-1.7.29.jar
slf4j-log4j12-1.7.29.jar

with the new files
reload4j-1.2.25.jar (here)
slf4j-api-1.7.36.jar (here)
slf4j-reload4j-1.7.36.jar (here)

Restart your server and make sure that everything still works properly as expected.