Log4J is a java based logging library. This library is widely used in many commercial and open source software products in the logging framework for java. A critical vulnerability has been identified in Log4j, which is very popular for Java-based applications.

The vulnerability, tracked as CVE-2021-44228, is called Log4Shell or LogJam, and it allows hacking of all systems from Log4j 2.0-beta9 to 2.14.1. As we mentioned, this vulnerability also affects Adobe ColdFusion, which uses the Java infrastructure. ColdFusion has been recommending workarounds and mitigation steps until an official patch is released.

After patch is released on 21/12/2021 and the final update arrives, the steps specified in the official source must be implemented. ColdFusion 2021 comes with Log4j versions 2.13.3 and 1.2, while the first is affected by this vulnerability, while the second is not. ColdFusion 2018 should be sent with log4j 2.13.3 and/or 2.9.0 and log4j 1.2. The first is affected by this vulnerability, while the second (i.e. v1.2) is not. ColdFusion (2016 release) comes with unaffected Log4j 1.2. If the installation includes software or libraries that use Log4j2, it is necessary to follow the steps that are detailed with the images below for version 2018 or 2021. After following these steps, to summarize briefly in order;

  1. Stopping Adobe ColdFusion App service,
  2. Updating the JVM configuration file,
  3. Replacing the log4j library with a new one,
  4. Performing ColdFusion update/upgrade,
  5. Re-configuring the web server,
  6. Re-entering the ColdFusion License key,
  7. Starting the Adobe ColdFusion App service.

Helpful Resources:

Feedback

Did you find this content helpful?