Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Update Java agent to use new version of log4j 2

See original GitHub issue

Is your feature request related to a problem? Please describe.

A well-publicized vulnerability has been discovered with certain versions of the log4j 2 framework. Some references:

Feature Description

Need to publish updated maint releases for the following major agent versions (these are still under support):

Java Agent 7.4.1
Java Agent 6.5.1
Java Agent 7.4.2
Java Agent 6.5.2
Java Agent 7.4.3
Java Agent 6.5.3

Describe Alternatives

A workaround to the issue has been described, to disable logging by setting the log level to off. See security bulletin NR21-03 for the latest mitigation actions.

Additional context

Older versions of the Java Agent that are not currently supported will not be updated, in alignment with our published EOL policy.

Priority

Critical

Issue Analytics

State:
Created 2 years ago
Reactions:2
Comments:20 (11 by maintainers)

Top GitHub Comments

3reactions

meiaocommented, Dec 20, 2021

@hpoettker agent 7.4.3 was released this morning with log4j 2.17.0.

3reactions

jinzishuaicommented, Dec 15, 2021

Any ETA for 6.5.2 ? Thanks.

Top Results From Across the Web

Log4j Zero Day Vulnerability and the New Relic Java Agent

We are using the following versions of new-relic agent 4.12.0 6.5.0 4.3.0 6.4.2 4.3.0 and we want to confirm whether system property fix...

Security Advisory: Apache Log4j Vulnerability

Versions prior to 21.11.2 are vulnerable to CVE-2021-45046. AppDynamics recommends that customers using Java Agent JDK 8+ upgrade to Java Agent ...

What is Apache Log4J Vulnerability and How to Prevent It?

Introduction. Log4Shell is a severe critical vulnerability affecting many versions of the Apache Log4j application. The vulnerability allows unauthenticated ...

Use Application Insights Java 2.x - Azure Monitor

Learn how to use the Application Insights Java 2.x, including sending trace logs, ... How should I update the SDK to the latest...

Java Agent version 1.x | APM Java Agent Reference [master]

With this version you can use any version of the public API once again - #2682 ... Update Log4j to 2.12.4 and log4j2-ecs-layout...