CE Log4j
4 views
Skip to first unread message
Brian Steuhl
Jun 26, 2026, 4:20:45 PMJun 26
to Orbeon Forms, Alessandro Vernet
We see that log4j-core-2.23.1.jar requires update in the CE and updating that jar causes an error and Orbeon fails to load.
Is there a workaround to getting log4j security issue resolved for log4j-core-2.23.1.jar
Regards,
Brian
Brian Steuhl
Website: http://cdibtm.com
Business Email: bst...@BTMSoftwareSolutions.com
Cell: 908-421-0742
Home Office: 908-421-0742
Is there a workaround to getting log4j security issue resolved for log4j-core-2.23.1.jar
Regards,
Brian
Brian Steuhl
Website: http://cdibtm.com
Business Email: bst...@BTMSoftwareSolutions.com
Cell: 908-421-0742
Home Office: 908-421-0742
Alessandro Vernet
Jun 26, 2026, 4:38:13 PMJun 26
to Orbeon Forms
Hi Brian,
If you're worried about Log4Shell (CVE-2021-44228), version 2.23.1 is well past that (it was fixed in 2.17), and from what I can see on the page linked below, it has no known vulnerability. Some versions released after 2.23.1 do have vulnerabilities, but none affect 2.23.1. So if your concern is specifically security, I don't see a reason to upgrade that library at this point. But please let me know if you were asking for another reason or if I misunderstood your question.
If you're worried about Log4Shell (CVE-2021-44228), version 2.23.1 is well past that (it was fixed in 2.17), and from what I can see on the page linked below, it has no known vulnerability. Some versions released after 2.23.1 do have vulnerabilities, but none affect 2.23.1. So if your concern is specifically security, I don't see a reason to upgrade that library at this point. But please let me know if you were asking for another reason or if I misunderstood your question.
Brian Steuhl
Jul 15, 2026, 4:01:29 PM (yesterday) Jul 15
to Orbeon Forms, Alessandro Vernet
Just following up on any way to update this jar file so orbeon doesnt fail to start?
--
You received this message because you are subscribed to the Google Groups "Orbeon Forms" group.
To unsubscribe from this group and stop receiving emails from it, send an email to orbeon+un...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/orbeon/422971258.2388702.1782497282612%40mail.yahoo.com.
You received this message because you are subscribed to the Google Groups "Orbeon Forms" group.
To unsubscribe from this group and stop receiving emails from it, send an email to orbeon+un...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/orbeon/422971258.2388702.1782497282612%40mail.yahoo.com.
Alessandro Vernet
Jul 15, 2026, 4:12:56 PM (yesterday) Jul 15
to Orbeon Forms
Hi Brian,
If you want to upgrade the log4j jars, you need to update all three jars (log4j-api, log4j-core, log4j-slf4j2-impl) with the same version, not just log4j-core. Does this help, or did I misunderstand your question?
-Alex
If you want to upgrade the log4j jars, you need to update all three jars (log4j-api, log4j-core, log4j-slf4j2-impl) with the same version, not just log4j-core. Does this help, or did I misunderstand your question?
-Alex
Brian Steuhl
9:44 AM (9 hours ago) 9:44 AM
to Orbeon Forms
Yes that answers the question thank you. I will attempt that update.
Regards,
BRian
To view this discussion visit https://groups.google.com/d/msgid/orbeon/CANrzKk%3DjBFKwDDeAu86_sYt0xtj1stDDvs9KB0Ni24%3DK896v4Q%40mail.gmail.com.
Regards,
BRian
Alessandro Vernet
10:10 AM (8 hours ago) 10:10 AM
to orb...@googlegroups.com
Perfect, Brian.
To view this discussion visit https://groups.google.com/d/msgid/orbeon/226096798.1776587.1784161489379%40mail.yahoo.com.
Reply all
Reply to author
Forward
0 new messages