GEODE-10580: Remediate CVE-2026-34478 - Improper Output Neutralization for Logs (#8006)

Upgrade Apache Log4j from 2.25.3 to 2.25.4 on support/1.15 to remediate
CVE-2026-34478 (CVSS 6.9 MEDIUM). Also corrects stale Log4j version
references (2.17.2, 2.12.0, 2.5) missed during the prior GEODE-10544
upgrade.

VULNERABILITY:
  Log4j Core's Rfc5424Layout (versions 2.21.0 through 2.25.3) is
  vulnerable to log injection via CRLF sequences due to undocumented
  renames of security-relevant configuration attributes (CWE-117,
  CWE-684). Two issues affect users of stream-based syslog services:
  - The newLineEscape attribute was silently renamed, disabling newline
    escaping for TCP framing (RFC 6587) and exposing CRLF injection.
  - The useTlsMessageFormat attribute was silently renamed, silently
    downgrading TLS framing (RFC 5425) to unframed TCP without newline
    escaping.

REMEDIATION:
  Updated all Log4j dependency references to 2.25.4 across dependency
  constraints, build files, expected POM, resource files, and
  documentation. Corrected stale 2.17.2/2.12.0/2.5 references that
  were missed by the prior GEODE-10544 upgrade.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-34478
  apache/logging-log4j2#4074
  https://logging.apache.org/security.html#CVE-2026-34478

Author: JinwooHwang

boms/geode-all-bom/src/test/resources/expected-pom.xml

@@ -530,27 +530,27 @@
       <dependency>
         <groupId>org.apache.logging.log4j</groupId>
         <artifactId>log4j-api</artifactId>
-        <version>2.17.2</version>
+        <version>2.25.4</version>
       </dependency>
       <dependency>
         <groupId>org.apache.logging.log4j</groupId>
         <artifactId>log4j-core</artifactId>
-        <version>2.17.2</version>
+        <version>2.25.4</version>
       </dependency>
       <dependency>
         <groupId>org.apache.logging.log4j</groupId>
         <artifactId>log4j-jcl</artifactId>
-        <version>2.17.2</version>
+        <version>2.25.4</version>
       </dependency>
       <dependency>
         <groupId>org.apache.logging.log4j</groupId>
         <artifactId>log4j-jul</artifactId>
-        <version>2.17.2</version>
+        <version>2.25.4</version>
       </dependency>
       <dependency>
         <groupId>org.apache.logging.log4j</groupId>
         <artifactId>log4j-slf4j-impl</artifactId>
-        <version>2.17.2</version>
+        <version>2.25.4</version>
       </dependency>
       <dependency>
         <groupId>org.apache.lucene</groupId>

build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy

@@ -39,7 +39,7 @@ class DependencyConstraints {
     deps.put("fastutil.version", "8.5.8")
     deps.put("javax.transaction-api.version", "1.3")
     deps.put("jgroups.version", "3.6.20.Final")
-    deps.put("log4j.version", "2.25.3")
+    deps.put("log4j.version", "2.25.4")
     deps.put("micrometer.version", "1.9.1")
     deps.put("shiro.version", "1.13.0")
     deps.put("slf4j-api.version", "1.7.36")

geode-assembly/src/acceptanceTest/resources/gradle-test-projects/management/build.gradle

@@ -25,7 +25,7 @@ repositories {
 
 dependencies {
   compile("${project.group}:geode-core:${project.version}")
-  runtime('org.apache.logging.log4j:log4j-slf4j-impl:2.12.0')
+  runtime('org.apache.logging.log4j:log4j-slf4j-impl:2.25.4')
 }
 
 application {

geode-assembly/src/integrationTest/resources/assembly_content.txt

@@ -1031,11 +1031,11 @@ lib/jna-5.11.0.jar
 lib/jna-platform-5.11.0.jar
 lib/joda-time-2.10.14.jar
 lib/jopt-simple-5.0.4.jar
-lib/log4j-api-2.17.2.jar
-lib/log4j-core-2.17.2.jar
-lib/log4j-jcl-2.17.2.jar
-lib/log4j-jul-2.17.2.jar
-lib/log4j-slf4j-impl-2.17.2.jar
+lib/log4j-api-2.25.4.jar
+lib/log4j-core-2.25.4.jar
+lib/log4j-jcl-2.25.4.jar
+lib/log4j-jul-2.25.4.jar
+lib/log4j-slf4j-impl-2.25.4.jar
 lib/lucene-analyzers-common-6.6.6.jar
 lib/lucene-analyzers-phonetic-6.6.6.jar
 lib/lucene-core-6.6.6.jar

geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt

@@ -28,11 +28,11 @@ jackson-datatype-jsr310-2.21.2.jar
 jackson-databind-2.21.2.jar
 swagger-annotations-2.2.1.jar
 jopt-simple-5.0.4.jar
-log4j-slf4j-impl-2.17.2.jar
-log4j-core-2.17.2.jar
-log4j-jcl-2.17.2.jar
-log4j-jul-2.17.2.jar
-log4j-api-2.17.2.jar
+log4j-slf4j-impl-2.25.4.jar
+log4j-core-2.25.4.jar
+log4j-jcl-2.25.4.jar
+log4j-jul-2.25.4.jar
+log4j-api-2.25.4.jar
 spring-context-5.3.20.jar
 spring-core-5.3.20.jar
 lucene-analyzers-phonetic-6.6.6.jar

geode-docs/managing/logging/configuring_log4j2.html.md.erb

@@ -36,16 +36,16 @@ You can also configure Log4j 2 to work with various popular and commonly used lo
 
 For example, if you are using:
 
--   **Commons Logging**, download "Commons Logging Bridge" (`log4j-jcl-2.17.2.jar`)
--   **SLF4J**, download "SLFJ4 Binding" (`log4j-slf4j-impl-2.17.2.jar`)
--   **java.util.logging**, download the "JUL adapter" (`log4j-jul-2.17.2.jar`)
+-   **Commons Logging**, download "Commons Logging Bridge" (`log4j-jcl-2.25.4.jar`)
+-   **SLF4J**, download "SLFJ4 Binding" (`log4j-slf4j-impl-2.25.4.jar`)
+-   **java.util.logging**, download the "JUL adapter" (`log4j-jul-2.25.4.jar`)
 
 See [http://logging.apache.org/log4j/2.x/faq.html](http://logging.apache.org/log4j/2.x/faq.html) for more examples.
 
-All three of the above JAR files are in the full distribution of Log4J 2.17.2 which can be downloaded at [http://logging.apache.org/log4j/2.x/download.html](http://logging.apache.org/log4j/2.x/download.html). Download the appropriate bridge, adapter, or binding JARs to ensure that <%=vars.product_name%> logging is integrated with every logging API used in various third-party libraries or in your own applications.
+All three of the above JAR files are in the full distribution of Log4J 2.25.4 which can be downloaded at [http://logging.apache.org/log4j/2.x/download.html](http://logging.apache.org/log4j/2.x/download.html). Download the appropriate bridge, adapter, or binding JARs to ensure that <%=vars.product_name%> logging is integrated with every logging API used in various third-party libraries or in your own applications.
 
 **Note:**
-<%=vars.product_name_long%> has been tested with Log4j 2.17.2. As newer versions of Log4j 2 come out, you can find 2.17.2 under Previous Releases on that page.
+<%=vars.product_name_long%> has been tested with Log4j 2.25.4. As newer versions of Log4j 2 come out, you can find 2.25.4 under Previous Releases on that page.
 
 ## Customizing Your Own log4j2.xml File
 

geode-docs/managing/logging/how_logging_works.html.md.erb

@@ -21,9 +21,9 @@ limitations under the License.
 
 <%=vars.product_name%> uses [Apache Log4j 2](http://logging.apache.org/log4j/2.x/) API and Core libraries as the basis for its logging system. Log4j 2 API is a popular and powerful front-end logging API used by all the <%=vars.product_name%> classes to generate log statements. Log4j 2 Core is a backend implementation for logging; you can route any of the front-end logging API libraries to log to this backend. <%=vars.product_name%> uses the Core backend to run three custom Log4j 2 Appenders: **GeodeConsole**, **GeodeLogWriter**, and **GeodeAlert**.
 
-<%=vars.product_name%> has been tested with Log4j 2.17.2.
+<%=vars.product_name%> has been tested with Log4j 2.25.4.
 <%=vars.product_name%> requires the 
-`log4j-api-2.17.2.jar` and `log4j-core-2.17.2.jar`
+`log4j-api-2.25.4.jar` and `log4j-core-2.25.4.jar`
 JAR files to be in the classpath.
 Both of these JARs are distributed in the `<path-to-product>/lib` directory and included in the appropriate `*-dependencies.jar` convenience libraries.
 

geode-docs/tools_modules/http_session_mgmt/weblogic_setting_up_the_module.html.md.erb

@@ -108,9 +108,9 @@ If you are deploying an ear file:
     lib/geode-serialization.1.0.0.jar
     lib/javax.transaction-api-1.3.jar
     lib/jgroups-3.6.8.Final.jar
-    lib/log4j-api-2.5.jar
-    lib/log4j-core-2.5.jar
-    lib/log4j-jul-2.5.jar
+    lib/log4j-api-2.25.4.jar
+    lib/log4j-core-2.25.4.jar
+    lib/log4j-jul-2.25.4.jar
     ```
 
 ## <a id="weblogic_setting_up_the_module__section_20294A39368D4402AEFB3D074E8D5887" class="no-quick-link"></a>Peer-to-Peer Setup

geode-server-all/src/integrationTest/resources/dependency_classpath.txt

@@ -42,11 +42,11 @@ jetty-http-9.4.57.v20241219.jar
 geode-memcached-0.0.0.jar
 rmiio-2.1.2.jar
 geode-tcp-server-0.0.0.jar
-log4j-jcl-2.17.2.jar
+log4j-jcl-2.25.4.jar
 geode-connectors-0.0.0.jar
 jackson-core-2.21.2.jar
 jetty-util-9.4.57.v20241219.jar
-log4j-slf4j-impl-2.17.2.jar
+log4j-slf4j-impl-2.25.4.jar
 lucene-analyzers-common-6.6.6.jar
 geode-membership-0.0.0.jar
 jetty-webapp-9.4.57.v20241219.jar
@@ -55,21 +55,21 @@ jopt-simple-5.0.4.jar
 swagger-annotations-2.2.0.jar
 snappy-0.4.jar
 geode-wan-0.0.0.jar
-log4j-api-2.17.2.jar
+log4j-api-2.25.4.jar
 geode-serialization-0.0.0.jar
 istack-commons-runtime-4.0.1.jar
 lucene-queryparser-6.6.6.jar
 jetty-io-9.4.57.v20241219.jar
 geode-deployment-legacy-0.0.0.jar
 commons-beanutils-1.11.0.jar
-log4j-core-2.17.2.jar
+log4j-core-2.25.4.jar
 shiro-crypto-core-1.13.0.jar
 jaxb-api-2.3.1.jar
 geode-unsafe-0.0.0.jar
 spring-shell-1.2.0.RELEASE.jar
 jaxb-impl-2.3.2.jar
 jna-platform-5.11.0.jar
-log4j-jul-2.17.2.jar
+log4j-jul-2.25.4.jar
 HdrHistogram-2.1.12.jar
 jackson-annotations-2.21.jar
 micrometer-core-1.9.1.jar