Hi,

I have recently upgraded my Urban Code Deploy to v6.2.7.17 but it still has log4j 1.2.17 jars in it. Since 1.x is out of support, it is coming as a vulnerability in our security scan. Can anyone help on how to resolve it.

Thanks

------------------------------
Mahesh PARKAR
------------------------------

Hi Mahesh, I've reached out to our experts with your question. You will hear from them soon. Thanks for reaching out on the community.

------------------------------
Divya Koppolu
------------------------------

Original Message:
Sent: Mon August 22, 2022 06:11 PM
From: Mahesh PARKAR
Subject: How to remove log4j 1.x jars from Urban Code

Hi,

I have recently upgraded my Urban Code Deploy to v6.2.7.17 but it still has log4j 1.2.17 jars in it. Since 1.x is out of support, it is coming as a vulnerability in our security scan. Can anyone help on how to resolve it.

Thanks

------------------------------
Mahesh PARKAR
------------------------------

------------------------------
Senthil Nathan
------------------------------

Original Message:
Sent: Mon August 22, 2022 06:11 PM
From: Mahesh PARKAR
Subject: How to remove log4j 1.x jars from Urban Code

Hi,

I have recently upgraded my Urban Code Deploy to v6.2.7.17 but it still has log4j 1.2.17 jars in it. Since 1.x is out of support, it is coming as a vulnerability in our security scan. Can anyone help on how to resolve it.

Thanks

------------------------------
Mahesh PARKAR
------------------------------

Thank you for the update. Vulnerability has been closed after upgrading UCD to v.7.2.3.1.

------------------------------
Mahesh PARKAR
------------------------------

Original Message:
Sent: Wed August 24, 2022 10:48 AM
From: Senthil Nathan
Subject: How to remove log4j 1.x jars from Urban Code

Hi Mahesh,
Only way to get log4j 2.* is to upgrade to IBM UCD 7.2.3.0 or above. We are not back-porting log4j 2.* to older versions, as those versions are not compatible. 

Also please note that we have patched log4j 1.2.17 jar, so that known CVEs of log4j 1.2 are addressed. But still some security scanning tools might flag them just based on the version of log4j. That is just unfortunate as vulnerable pieces of log4j are removed from the jar that we ship with v6.2.7.17. 

------------------------------
Senthil Nathan

Original Message:
Sent: Mon August 22, 2022 06:11 PM
From: Mahesh PARKAR
Subject: How to remove log4j 1.x jars from Urban Code

Hi,

I have recently upgraded my Urban Code Deploy to v6.2.7.17 but it still has log4j 1.2.17 jars in it. Since 1.x is out of support, it is coming as a vulnerability in our security scan. Can anyone help on how to resolve it.

Thanks

------------------------------
Mahesh PARKAR
------------------------------