Horizon 7.x

[worker405]

I have seen it is required by the HTML components of Horizon, what would be the downside of just removing log4j all together until the patch cycle is able to catch up?

[zenmatrix]

You risk breaking things, you can though remove the hmtl component if you don't use it, but that requires uninstalling and reinstalling the connection server

[worker405]

Do we know specifically what would break by doing so?

[Jubish-Jose]

If you do not want to remove the HTML component, you can try the scripted mitigation steps.

https://kb.vmware.com/s/article/87073