PVCS Version Manager is not affected by these vulnerabilities in log4j 1.2.17, despite what a vulnerability scanner might say. CVE -2019-17571 Exploiting this issue requires a configuration using the SocketServer to listen for network traffic, which is not being used by PVCS Version Manager.