Skip to content

GEODE-10580: Remediate CVE-2026-34478 - Improper Output Neutralization for Logs (support/1.15) #8006

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
JinwooHwang wants to merge 1 commit into
base: support/1.15
Choose a base branch
from
Open

GEODE-10580: Remediate CVE-2026-34478 - Improper Output Neutralization for Logs (support/1.15) #8006

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions boms/geode-all-bom/src/test/resources/expected-pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -530,27 +530,27 @@
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
<version>2.17.2</version>
<version>2.25.4</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>2.17.2</version>
<version>2.25.4</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-jcl</artifactId>
<version>2.17.2</version>
<version>2.25.4</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-jul</artifactId>
<version>2.17.2</version>
<version>2.25.4</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-slf4j-impl</artifactId>
<version>2.17.2</version>
<version>2.25.4</version>
</dependency>
<dependency>
<groupId>org.apache.lucene</groupId>
Expand Down
2 changes: 1 addition & 1 deletion ...y-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ class DependencyConstraints {
deps.put("fastutil.version", "8.5.8")
deps.put("javax.transaction-api.version", "1.3")
deps.put("jgroups.version", "3.6.20.Final")
deps.put("log4j.version", "2.25.3")
deps.put("log4j.version", "2.25.4")
deps.put("micrometer.version", "1.9.1")
deps.put("shiro.version", "1.13.0")
deps.put("slf4j-api.version", "1.7.36")
Expand Down
2 changes: 1 addition & 1 deletion geode-assembly/src/acceptanceTest/resources/gradle-test-projects/management/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ repositories {

dependencies {
compile("${project.group}:geode-core:${project.version}")
runtime('org.apache.logging.log4j:log4j-slf4j-impl:2.12.0')
runtime('org.apache.logging.log4j:log4j-slf4j-impl:2.25.4')
}

application {
Expand Down
10 changes: 5 additions & 5 deletions geode-assembly/src/integrationTest/resources/assembly_content.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1031,11 +1031,11 @@ lib/jna-5.11.0.jar
lib/jna-platform-5.11.0.jar
lib/joda-time-2.10.14.jar
lib/jopt-simple-5.0.4.jar
lib/log4j-api-2.17.2.jar
lib/log4j-core-2.17.2.jar
lib/log4j-jcl-2.17.2.jar
lib/log4j-jul-2.17.2.jar
lib/log4j-slf4j-impl-2.17.2.jar
lib/log4j-api-2.25.4.jar
lib/log4j-core-2.25.4.jar
lib/log4j-jcl-2.25.4.jar
lib/log4j-jul-2.25.4.jar
lib/log4j-slf4j-impl-2.25.4.jar
lib/lucene-analyzers-common-6.6.6.jar
lib/lucene-analyzers-phonetic-6.6.6.jar
lib/lucene-core-6.6.6.jar
Expand Down
10 changes: 5 additions & 5 deletions geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,11 +28,11 @@ jackson-datatype-jsr310-2.21.2.jar
jackson-databind-2.21.2.jar
swagger-annotations-2.2.1.jar
jopt-simple-5.0.4.jar
log4j-slf4j-impl-2.17.2.jar
log4j-core-2.17.2.jar
log4j-jcl-2.17.2.jar
log4j-jul-2.17.2.jar
log4j-api-2.17.2.jar
log4j-slf4j-impl-2.25.4.jar
log4j-core-2.25.4.jar
log4j-jcl-2.25.4.jar
log4j-jul-2.25.4.jar
log4j-api-2.25.4.jar
spring-context-5.3.20.jar
spring-core-5.3.20.jar
lucene-analyzers-phonetic-6.6.6.jar
Expand Down
10 changes: 5 additions & 5 deletions geode-docs/managing/logging/configuring_log4j2.html.md.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,16 +36,16 @@ You can also configure Log4j 2 to work with various popular and commonly used lo

For example, if you are using:

- **Commons Logging**, download "Commons Logging Bridge" (`log4j-jcl-2.17.2.jar`)
- **SLF4J**, download "SLFJ4 Binding" (`log4j-slf4j-impl-2.17.2.jar`)
- **java.util.logging**, download the "JUL adapter" (`log4j-jul-2.17.2.jar`)
- **Commons Logging**, download "Commons Logging Bridge" (`log4j-jcl-2.25.4.jar`)
- **SLF4J**, download "SLFJ4 Binding" (`log4j-slf4j-impl-2.25.4.jar`)
- **java.util.logging**, download the "JUL adapter" (`log4j-jul-2.25.4.jar`)

See [http://logging.apache.org/log4j/2.x/faq.html](http://logging.apache.org/log4j/2.x/faq.html) for more examples.

All three of the above JAR files are in the full distribution of Log4J 2.17.2 which can be downloaded at [http://logging.apache.org/log4j/2.x/download.html](http://logging.apache.org/log4j/2.x/download.html). Download the appropriate bridge, adapter, or binding JARs to ensure that <%=vars.product_name%> logging is integrated with every logging API used in various third-party libraries or in your own applications.
All three of the above JAR files are in the full distribution of Log4J 2.25.4 which can be downloaded at [http://logging.apache.org/log4j/2.x/download.html](http://logging.apache.org/log4j/2.x/download.html). Download the appropriate bridge, adapter, or binding JARs to ensure that <%=vars.product_name%> logging is integrated with every logging API used in various third-party libraries or in your own applications.

**Note:**
<%=vars.product_name_long%> has been tested with Log4j 2.17.2. As newer versions of Log4j 2 come out, you can find 2.17.2 under Previous Releases on that page.
<%=vars.product_name_long%> has been tested with Log4j 2.25.4. As newer versions of Log4j 2 come out, you can find 2.25.4 under Previous Releases on that page.

## Customizing Your Own log4j2.xml File

Expand Down
4 changes: 2 additions & 2 deletions geode-docs/managing/logging/how_logging_works.html.md.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,9 +21,9 @@ limitations under the License.

<%=vars.product_name%> uses [Apache Log4j 2](http://logging.apache.org/log4j/2.x/) API and Core libraries as the basis for its logging system. Log4j 2 API is a popular and powerful front-end logging API used by all the <%=vars.product_name%> classes to generate log statements. Log4j 2 Core is a backend implementation for logging; you can route any of the front-end logging API libraries to log to this backend. <%=vars.product_name%> uses the Core backend to run three custom Log4j 2 Appenders: **GeodeConsole**, **GeodeLogWriter**, and **GeodeAlert**.

<%=vars.product_name%> has been tested with Log4j 2.17.2.
<%=vars.product_name%> has been tested with Log4j 2.25.4.
<%=vars.product_name%> requires the
`log4j-api-2.17.2.jar` and `log4j-core-2.17.2.jar`
`log4j-api-2.25.4.jar` and `log4j-core-2.25.4.jar`
JAR files to be in the classpath.
Both of these JARs are distributed in the `<path-to-product>/lib` directory and included in the appropriate `*-dependencies.jar` convenience libraries.

Expand Down
6 changes: 3 additions & 3 deletions geode-docs/tools_modules/http_session_mgmt/weblogic_setting_up_the_module.html.md.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,9 +108,9 @@ If you are deploying an ear file:
lib/geode-serialization.1.0.0.jar
lib/javax.transaction-api-1.3.jar
lib/jgroups-3.6.8.Final.jar
lib/log4j-api-2.5.jar
lib/log4j-core-2.5.jar
lib/log4j-jul-2.5.jar
lib/log4j-api-2.25.4.jar
lib/log4j-core-2.25.4.jar
lib/log4j-jul-2.25.4.jar
```

## <a id="weblogic_setting_up_the_module__section_20294A39368D4402AEFB3D074E8D5887" class="no-quick-link"></a>Peer-to-Peer Setup
Expand Down
10 changes: 5 additions & 5 deletions geode-server-all/src/integrationTest/resources/dependency_classpath.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,11 +42,11 @@ jetty-http-9.4.57.v20241219.jar
geode-memcached-0.0.0.jar
rmiio-2.1.2.jar
geode-tcp-server-0.0.0.jar
log4j-jcl-2.17.2.jar
log4j-jcl-2.25.4.jar
geode-connectors-0.0.0.jar
jackson-core-2.21.2.jar
jetty-util-9.4.57.v20241219.jar
log4j-slf4j-impl-2.17.2.jar
log4j-slf4j-impl-2.25.4.jar
lucene-analyzers-common-6.6.6.jar
geode-membership-0.0.0.jar
jetty-webapp-9.4.57.v20241219.jar
Expand All @@ -55,21 +55,21 @@ jopt-simple-5.0.4.jar
swagger-annotations-2.2.0.jar
snappy-0.4.jar
geode-wan-0.0.0.jar
log4j-api-2.17.2.jar
log4j-api-2.25.4.jar
geode-serialization-0.0.0.jar
istack-commons-runtime-4.0.1.jar
lucene-queryparser-6.6.6.jar
jetty-io-9.4.57.v20241219.jar
geode-deployment-legacy-0.0.0.jar
commons-beanutils-1.11.0.jar
log4j-core-2.17.2.jar
log4j-core-2.25.4.jar
shiro-crypto-core-1.13.0.jar
jaxb-api-2.3.1.jar
geode-unsafe-0.0.0.jar
spring-shell-1.2.0.RELEASE.jar
jaxb-impl-2.3.2.jar
jna-platform-5.11.0.jar
log4j-jul-2.17.2.jar
log4j-jul-2.25.4.jar
HdrHistogram-2.1.12.jar
jackson-annotations-2.21.jar
micrometer-core-1.9.1.jar
Expand Down