Following up on BKBK's suggestion of how to proceed with updates, as well a tracker ticket he offered (on log4j 2.17.1), I have a couple of thoughts that I hope may help some readers, based on how I (as well as he) have been helping folks with these updates for a couple of weeks.
1) Curiously, BKBK, that tracker ticket is not there. Did you get notification from them as to why? I see someone else created one the next day, https://tracker.adobe.com/#/view/CF-4212654, so folks could at least watch that (and vote for that, as I just did).
2) Also, as for his instructions to backup and restore "of any hotfix JARs present in Update 12"), I do fear some readers might easily missing some subtle points.
a) First, when he refers to "any hotfix jars present" in that lib/updates folder, please note he means any jars whose names start with "hf". Those are special hotfix jars that Adobe sometimes offers to fix bugs in some given CF update. (I have a blog post with more on those, if interested.) My point here, though, is that you will ALSO see there a file starting with a whose names "chf", and that is THE hotfix file for that update you're currently on. You do NOT want to "restore" that older CHF jar into your new update, only any HF jars.
b) Further, you really do want to do this only if you are the previous CF update, update 12 in the case of CF2018. If you are on any PRIOR update of CF2018 before doing this latest update, and you find any hotfix jars there, you do NOT want to restore those. They are fixes to previous updates, which were resolved in later updates. More on that in a moment.
c) Third and finally, he is referring to "update 12" (of CF2018) here simply because he was responding to a question regarding CF2018,. But all this applies as well to CF2021. Those who may be on update 2, who find any hf*.jar files in the lib/updates, would want to restore those after doing update 3. (But if you are on update 1 or have no updates, then don't restore any hf*.jar files.)
3) For those whose heads may be spinning and who could use some additional context: the problem all this is referring to is that update 12 of CF2018 (as well as update 2 of CF2021) had some bugs, and Adobe offered some hotfix jar (hf*.jar) files to address those, which some people had added to their update 12 (or update 2 of CF2021) implementations. When you move to update 13 (or update 3 of CF2021)--or indeed when you move to any new CF update, the update mechanism intentionally removes any such hf.* jar files that had been in the lib/updates. The update mechanism presumes that the new update incorporates any and all fixes to the prior updates.
But in the case of this latest emergency CF update released Dec 17, Adobe ONLY took the previous version (update 12 for CF2018, or update 2 of CF2021) and they modified it to update the log4j 2 files (to 2.16) and also to update some log4j1 jars. But they specifically did NOT incorporate ANY bug fixes to updates 12 or 2.
And this is why people who move from THOSE updates--who had applied hotfix jars to THOSE updates--need to re-implement those hotfix jars.
On the other hand, if you are MOVING to these latest versions of CF2018 or 2021 from some EARLIER version, now YOU are faced with the prospect of being hit by the bugs that were introduced in updates 12 and 2, respectively, and which remain in updates 13 and 3.
4) Yes, all this is messy. Yes, some will complain that they SHOULD have rolled in any and all current bug fixes. But that would take time to do, test, do integration testing, etc. and as this was an emergency update they opted for just modifying things based on the previous update.
Others (especially those on update 12 or 2, with such hotfixes) might have complained if they HAD done anything more than "just address the log4j issue".
And of course, still others will wish they had somehow provided for ONLY dealing with that for WHATEVER current update (of CF2018 or 2021) that someone was on. Then folks who had NOT yet moved to update 12 or update 2 would not now be encountering issues. (And sadly, no, there is no current listing from Adobe of what hotfixes DO exist for updates 12/2 that should be considered for those moving to updates 13/3.)
This is the current state of things, and we now wait for Adobe to clarify proceeding with updating to the 2.17.1 (or later) jars.
We can certainly expect that some later update 14 or 4 WILL incorporate the needed bug fixes...unless some new emergency interrupts those plans.
(And of course, none of this discussion of 2.x log4j jars applies to CF2016 or earlier, as they don't include that by default. And Adobe has offered no guidance on updating the log4j 1.x jars they may contain.)
PS Actually, there is still one remaining issue. As I brought up back on Dec 27 here (as have others), even CF2021 and 2018 include log4j 1.x jars in the cfusion/jetty folder (if one added the CF "add on service") that were NOT modified by the update to CF. Adobe has yet to respond to or address that, that I have seen.
/Charlie (troubleshooter, carehart.org)
1 Correct answer
188
Replies
AdChoices