Log4j 2.17 breaks cfhtmltopdf

@davidihill ,

What version are you on?

CF2018 Update 12?

CF2018 Update 13?

CF2021 Update 2?

CF2021 Update 3?

 

When I updated Log4j to 2.17 as recommended (https://helpx.adobe.com/coldfusion/kb/log4j-2-16-vulnerability-coldfusion.html), cfhtmltopdf immediately started throwing a generic "server error". Anyone else encounter this?

By @davidihill

I updated ColdFusion 2018 from Update 12 to Update 13 following the steps in the link you mention. Then I ran the following code from the cfhtmltopdf documentation:

<cftry>
	<cfhtmltopdf destination="usage_example.pdf"
				  source="http://www.google.com" overwrite="true"  
				  orientation="portrait"  pagetype="A4" margintop="1" marginbottom="1" 
				  marginleft="1" marginright="1" />

	<cfheader name="Content-Disposition" value="inline; filename=usage_example.pdf">
	<cfcontent file="#getdirectoryfrompath(getbasetemplatepath())#usage_example.pdf" type="application/pdf" >

	<cfcatch type="any" >
		<cfdump var="#cfcatch#" >
	</cfcatch>
</cftry>

The result was a PDF, as expected. There was no error,.

David, I can say I've not seen or heard of that issue yet, but a few questions may point you in the right direction, or help us help you:

• What version of cf are you on? You didn't say. 
• And when you followed those steps, had you previously updated to the December cf update? You are not to do them INSTEAD of the update. Nor are they for versions below cf2018. 
• Did the install log for that Cf update show 0 fatalerrors and nonfatalerrors? Often problems are an a cf update are more of a reflection of a problem DURING the implementation of the update, rather than due to the update itself. 
• When you copied in the files from the zip, did you only copy in the 3 listed? And to the cfusion/lib? 
• And did you remove the 3 listed? Not just renaming them? 
• Did you do ANYTHING in the cfusion/jetty folder? The technote didn't say to. The cfhtmltopdf relies on the "cf add on service", which runs via code in that folder.
• Finally, did you or anyone else manipulate the jvm that Cf uses? More specifically, did anyone modify the coldfusion jre folder, which the jetty config points to by default?
• There are a few more I could ask, but let's stop at these

And it may technically have NOT been related to the update. Something could have been changed previously that did not take effect UNTIL the restart of both cf and the add-on service, which the update does. 

As you can see, there are many things you could have done (some without realizing their impact) that could explain your error. I hope these observations and questions may help get to the bottom of the problem. Please do answer them all if you don't find the solution (and if you do, please let us know what it was). 

And if somehow you need this solved ASAP, I can help via direct remote consulting. I suspect this might be solved in less than 15 mins, whereas back and forth here could take a lot longer. More at carehart.org/consulting.  But hope the above may well help get you going.