Apache Tomcat not vulnerable?

[delgurth]

In the list it says Apache Tomcat is vulnerable. But looking at the source, Tomcat is not mentioned.

Log4j says that you need to add log4j2 to tomcat in order for it to work. So a default tomcat does not have log4j2.

This is also pointed out in the Tomcat documentation itself:

The internal logging for Apache Tomcat uses JULI, a packaged renamed fork of Apache Commons Logging that is hard-coded to use the java.util.logging framework. This ensures that Tomcat's internal logging and any web application logging will remain independent, even if a web application uses Apache Commons Logging.