Tomcat 7.x is considered “fairly new” in my current company. Log4j didn’t hit us because the libraries we used were too old stable.