Finding Log4j in your code with GitHub’s security tooling
The Apache Log4j remote code execution vulnerability (CVE-2021-44228) in versions before 2.16.0 has pushed teams to audit their Java dependencies quickly. GitHub’s own response covered GitHub.com, Enterprise Cloud, and Enterprise Server; for your own repositories, Dependabot and CodeQL can help identify explicit Log4j usage and flag potential injection points.
Upgrading is the first move
The recommended fix remains upgrading to Log4j 2.16.0. If an immediate upgrade isn’t possible, GitHub advises mitigating by setting the -Dlog4j2.formatMsgNoLookups=true system property on both client- and server-side components.
Dependabot for surfaced dependency alerts
If you manage Java dependencies with Maven, enabling Dependabot will show every place Log4j is declared as a direct dependency and raise alerts plus pull requests for the patched version. GitHub has already sent more than 175,000 alerts and pull requests related to this vulnerability. Organization- or server-wide views of these alerts are available from the advisory database:
- https://github.com/advisories/GHSA-jfh8-c2jp-5v3q/dependabot
- https://<your-github-enterprise-server>/advisories/GHSA-jfh8-c2jp-5v3q/dependabot
Dependabot will not currently alert for Gradle or other dependency management systems; Gradle support for alerts is on GitHub’s public roadmap.
CodeQL for locating vulnerable code paths
For GitHub Advanced Security customers and public open-source maintainers, GitHub has published an experimental CodeQL query that detects untrusted user data flowing into Log4j logging statements. When a codebase depends on a vulnerable Log4j version, alerts from this query strongly indicate real exploit risk.
You can execute the query through the CodeQL CLI or add it to GitHub code scanning by referencing it in the queries directive of your CodeQL workflow:
Recommended actions
As the industry patches, GitHub suggests enabling Dependabot as part of your response. It won’t give a complete exposure map, but it rapidly surfaces directly declared dependencies that can be upgraded. For Advanced Security users, the experimental CodeQL query adds a layer of detection. Documentation for enabling Dependabot on Cloud and Server, understanding dependency graphs, and upgrading GitHub Enterprise Server with a hot patch is available from GitHub’s docs.
