Log4j vulnerability in jetty and CFBuilder

[aliciam29605858]

Hi,

I read the posts about log4j but it seems like there is still an unresolved vulnerability in the jetty\lib\ext\log4j-1.2.17.jar file?  Was this ever resolved?

Also, our scanners are flagging log4j under CFBuilder, I haven't seen any mitigation steps for that, did I miss something?  These are reported (from the root ColdFusion Builder directory):

plugins\com.adobe.ide.coldfusion.dictionary_3.2.1.201902041055\lib\log4j-1.2.9.jar

\configuration\org.eclipse.osgi\31\0\.cp\lib\log4j-1.2.9.jar

Thanks for any information,

Alicia

[Charlie Arehart]

The first is more widely known. No fix yet, so we can only hope a next cf update will address this soon.

As for cfbuilder, I'd not yet heard that. I do NOT expect we'll see any update for that, until the new cfbuilder due to be rewritten atop vscode. But Adobe may surprise us with an update for cfbuilder 2018,simce that's still formally supported... if indeed they've noticed what you share here. We should hope they have.

Or maybe you will hear here a more official answer from Adobe on all this. Until then, hope this helps. 

[Dave Watts]

I'm going to guess that (a) the vulnerability still exists in the Jetty server that runs Apache Solr and whatever else, and (b) Adobe isn't going to release patches for this since it's not actually exposed to public attackers, and finally (c) it would be difficult for Adobe to patch this even if they wanted to, because it's third-party software.

Also, I doubt that you'll find mitigation steps for this with CF Builder, because it's not a service, just a developer tool. Public attackers can't get to it unless you've done something really wrong with your network configuration. So, in my opinion, it probably makes sense for Adobe to just ignore that until they're ready to release the next version of CF Builder. That's just my opinion, though.

Dave Watts, Eidolon LLC