Log4j 2.15.0 update issue

Question

My application is using Log4j 2.11.1 now. Because of the Log4j security vulnerabilities reported a couple of days ago, I need to update Log4j to 2.15.0. But it fails when I deploy my application on a Linux server.

Here is the error message:

[ERROR] Failed to execute goal on project ***: Could not resolve dependencies for project ***:1.0-SNAPSHOT: Failed to collect dependencies at org.apache.logging.log4j:log4j-api:jar:2.15.0: Failed to read artifact descriptor for org.apache.logging.log4j:log4j-api:jar:2.15.0: Could not transfer artifact org.apache.logging.log4j:log4j-api:pom:2.15.0 from/to central (https://repo1.maven.org/maven2): sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target -> [Help 1]

I've added the certificate of Maven 2 to my Java keystore, but it does not work. My Java version is 1.8.181.

score 3 · Answer 1 · edited Jan 05 '22 at 18:00

3

I had log4j-core and log4j-api which needed to be updated. It is a similar case as you had, deployment on as a Linux server. It works for me.

<dependency>
  <groupId>org.apache.logging.log4j</groupId>
  <artifactId>log4j-1.2-api</artifactId>
  <version>2.15.0</version>
</dependency>

<dependency>
  <groupId>org.apache.logging.log4j</groupId>
  <artifactId>log4j-core</artifactId>
  <version>2.15.0</version>
</dependency>

I added these dependencies and updated the maven project (in the Eclipse IDE, right click on Project → Go to Maven → Update Project).

Log4j Vulnerability issue with later versions

The version Log4j 2.15.0 was released as a possible fix for this critical vulnerability, but this version was found to be still vulnerable (by Apache Software Foundation).

Solution: Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

edited Jan 05 '22 at 18:00

Peter Mortensen

30,738
21
105
131

answered Dec 14 '21 at 12:33

Umar

49
5

I added the above dependencies, but still my dependency tree shows below only, +- org.apache.logging.log4j:log4j-api:jar:2.11.2:compile [INFO] | +- org.apache.logging.log4j:log4j-core:jar:2.11.2:compile Any reason for this? – Sathish Kumar Dec 15 '21 at 03:22
@SathishKumar- do share the exact logs of the compilation error if issue still there. part of the dependency tree doesn't give clue about it. – Umar Dec 15 '21 at 14:51
I have found the problem, it was from a transitive dependency coming in from one of other projects. – Sathish Kumar Dec 30 '21 at 11:22

score 1 · Answer 2 · edited Jan 05 '22 at 17:44

1

You can have a look at Maven, Ivy, Gradle, and SBT Artifacts.

In my case I had to switch from 1.2.x version to 2.16.0.

You can try using this dependency:

<dependencies>
    <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-1.2-api</artifactId>
        <version>2.16.0</version>
    </dependency>
</dependencies>

edited Jan 05 '22 at 17:44

Peter Mortensen

30,738
21
105
131

answered Dec 13 '21 at 14:03

stefano cipriani

11
3

I tried your suggestion, but an artifact named "log4j-1.2-api" is not found. – Tillmann Dec 13 '21 at 15:16

score 0 · Answer 3 · edited Jan 05 '22 at 17:55

As Log4j security vulnerabilities are addressed in log4j-core, please try the latest version of log4j-core using a Maven dependency:

<dependency>
    <groupId>org.apache.logging.log4j</groupId>
    <artifactId>log4j-core</artifactId>
    <version>2.16.0</version>
</dependency>

Reference - Maven Repository: log4j

Regarding the exception you are facing, this may help you - Java: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

score 0 · Answer 4 · edited Jan 05 '22 at 18:05

Specifically for a "PKIX path building failed" error in Maven:

If you are on Windows and your IT folks have added transparent proxies that intercept SSL traffic, you'll want to set MAVEN_OPTS to the following:

-Djavax.net.ssl.keyStoreType=Windows-MY -Djavax.net.ssl.trustStoreType=Windows-ROOT

This will direct Maven to use the Windows trust store when vetting SSL certificates issued internally by your IT staff.

If it is a transparent proxy peeking at SSL, but you're not in Windows, you may need to add that certificate to your JVMs trusted keystore, as the JVM options I have only work on Windows.

score 0 · Answer 5 · edited Jan 05 '22 at 18:07

I faced the same problem with the following dependency:

<dependency>
    <groupId>org.apache.logging.log4j</groupId>
    <artifactId>log4j</artifactId>
    <version>2.15.0</version>
</dependency>

I replaced the above dependency with:

<dependency>
    <groupId>org.apache.logging.log4j</groupId>
    <artifactId>log4j-1.2-api</artifactId>
    <version>2.15.0</version>
</dependency>

It works OK.

Log4j 2.15.0 update issue

5 Answers5

Log4j Vulnerability issue with later versions