Should we do something regarding Log4j vulnerability when we are using it for Testing?( TestNg Framework)

Question

We are using TestNG framework with Log4j for preparing end to end tests. Should we take some action?

Answer 1

Just because the vulnerability is only in your test dependencies, does not mean you could ignore it.

However you should be under full control of your input and this should cover all possible log messages as well. So you could assume that nobody from outside can easily exploit this vulnerability. So if are not planning to add injection Strings to your test data, you should be OK.
I recommend to update anyway, as you never know if it could be used in some way of exploit chain (another exploit in the future might rewrite your input, and that ends up in the logging). But it has a lower priority than fixing any public available server.

Version 2.15.0 of log2j contains the fix.