log4j-1.2.12 vulnerability reported even on the latest TeamCity version

Symptoms

• The following files are reported as vulnerable: <TeamCity Server Home>/buildAgent/lib/log4j-1.2.12.jar <TeamCity Server Home>/buildAgent/lib/log4j-1.2.12-json-layout.jar <TeamCity Server Home>/buildAgent/launcher/lib/log4j-1.2.12.jar
• According to the documentation, TeamCity has not been using log4j-1.2.12 since the 2022.04 version.

Cause

The <TeamCity Server Home>/buildAgent directory is the directory where the default build agent is installed.

The most probable cause is that this default agent had not been used for a long time, so it was not being updated.

Resolution

If the default agent is not being used at all, the <TeamCity Server Home>/buildAgent directory can be safely deleted.

Alternatively, this default agent can be started, and it will be automatically updated once it connects to the TeamCity server.