The exact(!) same question was asked by @Rohit_Dabas eralier today. Please look here: Log4J Vulnerabilities