Skip to main content
B
Benjamin5E81
Known Participant
March 21, 2022
Answered

Log4J 1.x Files...

  • March 21, 2022
  • 1 reply
  • 584 views

So recently our security appliance started locating log4j 1.x files within many directories of ColdFusion.  Would it be safe to delete these files since CF2018u13 no longer uses them?

 

Example: <CF2018>\cfusion\jetty\lib\ext\log4j-1.2.17.jar

 

Thanks!

    This topic has been closed for replies.
    Correct answer Charlie Arehart

    Well, that specific one would be safe to delete if you don't use or plan to use the cf "add on service", but as you allude to, that's not the only one to be concerned with. More in a moment. 

     

    First, that one in the cfusion/jetty folder supports the cf solr search engine and the pdf processing engine for cfhtmltopdf (new since cf11, and entirely UNRELATED to the older pdf processing engine supporting cfdocument). Both are known and controlled by the cf "add-on service". 

     

    Just beware that a future cf update you'd apply could lay that file back down. That's how cf updates work--they lay down all the files from prior updates, cumulatively.

     

    Note that we should STRONGLY hope that some FUTURE cf update--perhaps the NEXT one--may remove all vestiges of log4j1 that remain a) in that jetty folder (in cf2018 AND cf2021) as well as b) in the cfusion/lib folder (in cf2018 and earlier only).

     

    You don't mention the latter file, though you are on cf2018. To be clear, you MUST NOT remove that log4j1x jar in the cfusion/lib of cf2018 or earlier, otherwise the cf startup will have a sever error and while cf will "start", page processing will fail. Again, hopefully this will be fixed in a coming cf2018 update (cf2016 is no longer updated since Mar 2021.)

     

    Let us know if this suffices to answer your question. 

    1 reply

    Charlie Arehart
    Community Expert
    Charlie ArehartCommunity ExpertCorrect answer
    Community Expert
    March 21, 2022

    Well, that specific one would be safe to delete if you don't use or plan to use the cf "add on service", but as you allude to, that's not the only one to be concerned with. More in a moment. 

     

    First, that one in the cfusion/jetty folder supports the cf solr search engine and the pdf processing engine for cfhtmltopdf (new since cf11, and entirely UNRELATED to the older pdf processing engine supporting cfdocument). Both are known and controlled by the cf "add-on service". 

     

    Just beware that a future cf update you'd apply could lay that file back down. That's how cf updates work--they lay down all the files from prior updates, cumulatively.

     

    Note that we should STRONGLY hope that some FUTURE cf update--perhaps the NEXT one--may remove all vestiges of log4j1 that remain a) in that jetty folder (in cf2018 AND cf2021) as well as b) in the cfusion/lib folder (in cf2018 and earlier only).

     

    You don't mention the latter file, though you are on cf2018. To be clear, you MUST NOT remove that log4j1x jar in the cfusion/lib of cf2018 or earlier, otherwise the cf startup will have a sever error and while cf will "start", page processing will fail. Again, hopefully this will be fixed in a coming cf2018 update (cf2016 is no longer updated since Mar 2021.)

     

    Let us know if this suffices to answer your question. 

    /Charlie (troubleshooter, carehart. org)
    M
    Matthew22377144yk0g
    Known Participant
    March 23, 2022

    Just adding that Adobe has made a statement regarding the 1.2.15 jar in cfusion/lib here which was enough to get our security folks to skip that file (and thanks to Charlie for mentioning the mitigation done to that file in a previous post).  We plan to apply the same mitigation steps to the 1.2.17 jar, as Adobe has yet to do it.

    Charlie Arehart
    Community Expert
    Charlie ArehartCommunity Expert
    Community Expert
    March 24, 2022

    Yes and I understand it.  As for the acceptance of the statement, each companies security stance is different.

     

    SAP and IBM, to name a few, released similar statements in January but recently started stating they are finally releasing updates to move to 2.17.1 or newer.  I hope Adobe will do the same instead of just releasing a statement that may or may not be accepted.


    Sure, but to be clear, Adobe had updated all the log4j 2 jars to 2.16 in Dec, the 2.17 weeks later, then 2.17.1 in January. We're talking above about the vestiges of log4j 1 jars, of course. And FWIW, Cf2021 has none, though its implementation of that same optional addon service does. Again, hoping that will be resolved soon. 

    /Charlie (troubleshooter, carehart. org)
    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices