Vulnerability related with file log4j.jar

[RobertoCervantes]

Hello,

we have installed Adobe Campaing Classic V7 and our security department have detected a vulnerability related with this installation. An obsolete version of log4j of the Adobe Campaign servers was detected, this component is installed in a subfolder of the Adobe installation :

• E:\Program Files\Adobe\Adobe Campaign Classic v7\java\lib\log4j-1.2.11.jar

Does anybody know if we can fix this vulnerability by replacing the jar file with a newer version of "log4j"? 

The case is that we can't upgrade the version of Adobe Campaign Classic easily and we need to fix this issue urgently.

Thank you very much!!

[DavidKangni · Accepted solution]

Hi @RobertoCervantes ,

The vulnerability is fixed in latest build. I will recommend to upgrade your build.

If it's not possible ASAP, you can check the following URL for a workaround.

https://experienceleaguecommunities.adobe.com/t5/adobe-campaign-classic-questions/log4j-for-adobe-ca...

Thanks,

David

[RobertoCervantes]

Ok understood. Thank you very much @DavidKangni 

[RobertoCervantes]

@DavidKangni, due to the lack of time and prioritisation of our security department we are going to perform a test in the development environment by modifying the "log4j-1.2.11.jar" file by the "log4j-2.20.0.jar" latest version inside the "\java\lib" folder.

I have seen that it will also be necessary to modify the configuration file "serverConf.xml" adding the path of the new version.

Can you think of any inconvenience or any other action to do to make everything work correctly? Could this change have any negative impact on future updates of the application?

Thank you very much for your time!