Hi Jonathan,
I have summarised information about this in my reply to an earlier discussion about log4j, which should cover all of the information you are after.
I hope that helps!
Security and privacy
Apache_Log4j_2_Vuln_v2-O
This discussion has been locked so you can no longer reply to it.