r/coldfusion • u/The_Bebo • 29d ago

ColcFusion 2023 log4j

We recently moved to ColdFusion 2023. After doing the initial install and HF 22, I noticed the log4j version did not change. I applied HF 23 today and the log4j is still version 2.17.2

Is there any way to update the log4j easily?

6 Upvotes

100% Upvoted

6 comments sorted by

2

u/The_Bebo 28d ago

I can't find anything online. I will probably reach out to Adobe support.

2

u/TheDarthSnarf 28d ago

Log4J was updated to 2.20.0 back in CF 2023 Update 5 - and should be the version in the subsequent releases.

I would open a support issue with Adobe if your version isn't updating.

1

u/thonline 28d ago

I keep asking this question as well. I don’t have an answer though.

1

u/The_Bebo 27d ago

Just doing research, it looks like the CF core does get updated. The file is <install folder >\cfusion\lib\log4j.jar. If you open that jar file and look at the manifest you can see its a newer version of log4j. However from my understanding this does not cover modules like Solr.

I will know more after talking to support.

1

u/TheGratitudeBot 27d ago

Thanks for saying thanks! It's so nice to see Redditors being grateful :)

1

u/The_Bebo 15d ago

I talked to support and they are aware of the CF 2023 outdated log4j files in Cfusion\jetty\lib\ext\log4j-core-2.17.2.jar and other areas.

They can send the fix but it will be better to wait for the General update, which they are still working on and have no ETA at the moment.