Difference between revisions of "Apache Log4j & CMOD ODWEK ICN"

Jump to navigation Jump to search

Apache Log4j & CMOD ODWEK ICN (view source)

Revision as of 22:10, 13 December 2021

1,461 bytes removed ,  22:10, 13 December 2021
m
Refer to technote instead.
m (Removed update at IBM's request.)
m (Refer to technote instead.)
Line 68: Line 68:


== Upgrading log4j v2.15.x ==
== Upgrading log4j v2.15.x ==
IBM has begun replying to customer tickets with this information:
  CMOD Lab is aware of the log4j vulnerability. See the below from the development.
 
  "neither the ODWEK nor the REST API’s use the JNDI feature of LOG4J which is at the core of the security vulnerability recently discovered. However, to be safe, it is recommended you upgrade to Log4j 2.15.0."
 
  Follow the instructions below to upgrade the OnDemand REST services or ODWEK based applications that are leveraging log4j.
 
  Go to https://downloads.apache.org/logging/log4j/2.15.0/ and select the file for your OS to download.
 
  E.g., apache-log4j-2.15.0-bin.zip for windows, apache-log4j-2.15.0-tar.gz for Unix.
 
  Once you extract the downloaded file, you should have a folder with a several files, including log4j-api-2.15.0.jar and log4j-core-2.15.0.jar. These are the only two files used by the OnDemand Web Enablement Kit and the REST API’s
 
  Use them to replace the following:
 
  <OnDemand Install Directory>/jars/log4j-api-2.13.0.jar
  <OnDemand Install Directory>/jars/log4j-core-2.13.0.jar
 
  You will need to stop any applications that use these files prior to replacing them. Delete the original 2.13.0 files. Place the log4j-api-2.15.0.jar and log4j-core-2.15.0.jar files into the directory that contained the deleted files. You will then need to update the classpath within your application server to reference the new version of these files. This is true for both ODWEK applications that use LOG4J and the OnDemand REST services. Once the classpath has been updated you can restart your applications"


Please refer to [https://www.ibm.com/support/pages/node/6525888 IBM's technote] for instructions on upgrading log4j on your CMOD installations.


== Questions & Responses ==
== Questions & Responses ==
Retrieved from "https://CMOD.wiki/index.php?title=Special:MobileDiff/1044"

Navigation menu