1. Home
  2. Portal
  3. Liferay CE Portal (liferay-ce-portal-7.4.0-ga1) : Log4j Vulnerability

Liferay CE Portal (liferay-ce-portal-7.4.0-ga1) : Log4j Vulnerability

Ashutosh Shukla, modified 1 Year ago.
Liferay CE Portal (liferay-ce-portal-7.4.0-ga1) : Log4j Vulnerability
New Member Posts: 5 Join Date: 3/12/24 Recent Posts

Hi Team,

 

We are using Liferay CE Portal (liferay-ce-portal-7.4.0-ga1) for our product development. 

 

In the above given version, we are facing log4j vulnerability (log4j-core-2.13.3.jar, log4j-api-2.13.3.jar) in "osgi/bundles" folder. 

 

We tried manually deleting the log4j-api-2.13.3.jar, log4j-core-2.13.3.jar versions and placed the updated versions log4j-api-2.17.0.jar, log4j-core-2.17.0.jar. But on restarting the servers, again the log versions are reverting back to 2.13. 

 

We also tried the mitigation fixes suggested in Liferay forum, such as: 

 

  1. Updating JVM parameter -Dlog4j2.formatMsgNoLookups=true in server startup file(setenv.sh).
  2. Deleting the JNDILookup.class file in Log4j Core jar and overriding the jars. (/disk/liferay-ce-portal-7.4.0-ga1/osgi/marketplace/override)

Liferay Forum Link (referred for above fix) : https://liferay.dev/blogs/-/blogs/log4j2-zero-day-vulnerability#:~:text=%2DDlog4j2.formatMsgNoLookups%3Dtrue,will%20be%20mitigated%20for%20you.

 

Currently, we will not be able to update our Liferay CE Versions for our product and moreover, the above work arounds are also not working as expected. We are still facing the critical security alerts for log4j. 

 

Requesting your help in providing us any suggestions or fixes available to overcome the above vulnerability.

7.4
thumbnail
Olaf Kock, modified 1 Year ago.
RE: Liferay CE Portal (liferay-ce-portal-7.4.0-ga1) : Log4j Vulnerability
Liferay Legend Posts: 6441 Join Date: 9/23/08 Recent Posts

The current release is GA125, e.g. you're missing more than 2years of updates.

The problem is fixed in the current release, if you can't upgrade, then this applies to all other bugfixes since then as well. That's a situation that I'd not want to be in. Further, I don't expect any volunteer to fix such an old version.

I'm assuming that the cost for somebody backporting all the bugfixes for you is a lot higher than the cost of staying somewhat current with your versions.

The best suggestion to fix issues is: Stay current.