• Global community
    • Language:
      • Deutsch
      • English
      • Español
      • Français
      • Português
  • 日本語コミュニティ
    Dedicated community for Japanese speakers
  • 한국 커뮤니티
    Dedicated community for Korean speakers
Exit
0

Log4j vulnerability in jetty and CFBuilder

Explorer ,
Apr 19, 2022 Apr 19, 2022

Copy link to clipboard

Copied

Hi,

I read the posts about log4j but it seems like there is still an unresolved vulnerability in the jetty\lib\ext\log4j-1.2.17.jar file?  Was this ever resolved?

 

Also, our scanners are flagging log4j under CFBuilder, I haven't seen any mitigation steps for that, did I miss something?  These are reported (from the root ColdFusion Builder directory):

plugins\com.adobe.ide.coldfusion.dictionary_3.2.1.201902041055\lib\log4j-1.2.9.jar

\configuration\org.eclipse.osgi\31\0\.cp\lib\log4j-1.2.9.jar

 

Thanks for any information,

Alicia

TOPICS
Builder , Security

Views

138

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Community Expert ,
Apr 19, 2022 Apr 19, 2022

Copy link to clipboard

Copied

The first is more widely known. No fix yet, so we can only hope a next cf update will address this soon.

 

As for cfbuilder, I'd not yet heard that. I do NOT expect we'll see any update for that, until the new cfbuilder due to be rewritten atop vscode. But Adobe may surprise us with an update for cfbuilder 2018,simce that's still formally supported... if indeed they've noticed what you share here. We should hope they have.

 

Or maybe you will hear here a more official answer from Adobe on all this. Until then, hope this helps. 


/Charlie (troubleshooter, carehart.org)

Votes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Community Expert ,
Apr 20, 2022 Apr 20, 2022

Copy link to clipboard

Copied

LATEST

I'm going to guess that (a) the vulnerability still exists in the Jetty server that runs Apache Solr and whatever else, and (b) Adobe isn't going to release patches for this since it's not actually exposed to public attackers, and finally (c) it would be difficult for Adobe to patch this even if they wanted to, because it's third-party software.

 

Also, I doubt that you'll find mitigation steps for this with CF Builder, because it's not a service, just a developer tool. Public attackers can't get to it unless you've done something really wrong with your network configuration. So, in my opinion, it probably makes sense for Adobe to just ignore that until they're ready to release the next version of CF Builder. That's just my opinion, though.

 

Dave Watts, Eidolon LLC

Votes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Resources
Documentation