開発者のArneBab氏のフリーサイトのコメントがこちら
Winterfaceyは非公式のプラグインで入れてなければ大丈夫な模様
Frostはかなり前に公式から外れてるので知らないらしいが
FreenetやFMSなどの公式プラグインはOKらしい

log4j

As far as I can tell, we are not using log4j in fred or any official plugin, and we also do not have it in freenet-ext (unzip the jar and grep -R -a -i log4j).

The unofficial plugin Winterface uses log4j, though: If you still have it loaded, it may be a good idea to unload it until there is a new release.

I don’t know about Frost.

If anyone has different information, please tell me! (on Sone or FMS)