Skip to content

GEODE-10555: Remediate CVE-2024-12798 CVE-2024-12801 CVE-2025-11226 CVE-2026-1225 #7982

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
JinwooHwang wants to merge 3 commits into
base: develop
Choose a base branch
from
Open

GEODE-10555: Remediate CVE-2024-12798 CVE-2024-12801 CVE-2025-11226 CVE-2026-1225 #7982

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3efa1ee
GEODE-10555: Remediate CVEs
JinwooHwang Feb 3, 2026
0f4acd2
Update geode-server-all expected dependency classpath
JinwooHwang Feb 4, 2026
0aa9919
Update assembly integration test expected files
JinwooHwang Feb 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,8 +80,11 @@ allprojects {
// Exclude 'log4j-to-slf4j' globally. Geode's logging architecture requires Log4j Core to be the primary logging implementation,
// with SLF4J calls being routed TO Log4j (via log4j-slf4j-impl), not the other way around.
//
// Logback is unused (transitive from spring-boot-starter-logging). Geode uses Log4j 2 for all logging.
//
configurations.all {
exclude group: 'org.apache.logging.log4j', module: 'log4j-to-slf4j'
exclude group: 'ch.qos.logback'
}

buildRoot = buildRoot.trim()
Expand Down
8 changes: 8 additions & 0 deletions extensions/geode-modules-tomcat10/src/test/resources/expected-pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand All @@ -66,6 +70,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
</dependency>
</dependencies>
Expand Down
28 changes: 28 additions & 0 deletions extensions/geode-modules/src/test/resources/expected-pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand All @@ -66,6 +70,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand All @@ -77,6 +85,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand All @@ -88,6 +100,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand All @@ -99,6 +115,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand All @@ -110,6 +130,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand All @@ -121,6 +145,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
</dependency>
</dependencies>
Expand Down
2 changes: 0 additions & 2 deletions geode-assembly/src/integrationTest/resources/assembly_content.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1017,8 +1017,6 @@ lib/log4j-core-2.25.3.jar
lib/log4j-jcl-2.25.3.jar
lib/log4j-jul-2.25.3.jar
lib/log4j-slf4j-impl-2.25.3.jar
lib/logback-classic-1.5.11.jar
lib/logback-core-1.5.11.jar
lib/lucene-analysis-common-9.12.3.jar
lib/lucene-analysis-phonetic-9.12.3.jar
lib/lucene-core-9.12.3.jar
Expand Down
2 changes: 0 additions & 2 deletions geode-assembly/src/integrationTest/resources/expected_jars.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,8 +84,6 @@ log4j-core
log4j-jcl
log4j-jul
log4j-slf4j-impl
logback-classic
logback-core
lucene-analysis-common
lucene-analysis-phonetic
lucene-core
Expand Down
10 changes: 4 additions & 6 deletions geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,11 +21,11 @@ spring-shell-starter-3.3.3.jar
spring-web-6.1.14.jar
commons-lang3-3.18.0.jar
rmiio-2.1.2.jar
jackson-datatype-jsr310-2.17.0.jar
jackson-datatype-joda-2.17.0.jar
jackson-annotations-2.17.0.jar
jackson-dataformat-yaml-2.17.0.jar
jackson-core-2.17.0.jar
jackson-datatype-jsr310-2.17.0.jar
jackson-dataformat-yaml-2.17.0.jar
jackson-databind-2.17.0.jar
swagger-annotations-2.2.22.jar
jaxb-runtime-4.0.2.jar
Expand Down Expand Up @@ -76,6 +76,7 @@ commons-io-2.19.0.jar
commons-logging-1.3.5.jar
classgraph-4.8.147.jar
micrometer-core-1.14.0.jar
HdrHistogram-2.2.2.jar
fastutil-8.5.8.jar
jakarta.resource-api-2.1.0.jar
jetty-ee10-annotations-12.0.27.jar
Expand Down Expand Up @@ -108,7 +109,6 @@ jetty-xml-12.0.27.jar
jetty-http-12.0.27.jar
jetty-io-12.0.27.jar
spring-boot-starter-logging-3.3.5.jar
logback-classic-1.5.11.jar
jul-to-slf4j-2.0.16.jar
jetty-jndi-12.0.27.jar
jetty-util-12.0.27.jar
Expand All @@ -117,8 +117,8 @@ byte-buddy-1.14.9.jar
micrometer-observation-1.14.0.jar
spring-jcl-6.1.14.jar
micrometer-commons-1.14.0.jar
HdrHistogram-2.2.2.jar
LatencyUtils-2.0.3.jar
snakeyaml-2.2.jar
reactor-core-3.6.10.jar
jline-console-3.26.3.jar
jline-builtins-3.26.3.jar
Expand All @@ -127,7 +127,6 @@ jline-style-3.26.3.jar
jline-terminal-3.26.3.jar
ST4-4.3.3.jar
txw2-4.0.2.jar
snakeyaml-2.2.jar
asm-commons-9.8.jar
asm-tree-9.8.jar
asm-9.8.jar
Expand All @@ -140,6 +139,5 @@ jakarta.enterprise.lang-model-4.0.1.jar
jakarta.validation-api-3.0.2.jar
jboss-logging-3.4.3.Final.jar
classmate-1.5.1.jar
logback-core-1.5.11.jar
jakarta.el-api-5.0.0.jar
jakarta.inject-api-2.0.1.jar
12 changes: 12 additions & 0 deletions geode-common/src/test/resources/expected-pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand All @@ -66,6 +70,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand All @@ -77,6 +85,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
</dependency>
</dependencies>
Expand Down
8 changes: 8 additions & 0 deletions geode-concurrency-test/src/test/resources/expected-pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand All @@ -66,6 +70,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
</dependency>
</dependencies>
Expand Down
52 changes: 52 additions & 0 deletions geode-connectors/src/test/resources/expected-pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand All @@ -66,6 +70,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand All @@ -77,6 +85,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand All @@ -88,6 +100,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand All @@ -99,6 +115,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand All @@ -110,6 +130,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand All @@ -121,6 +145,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand All @@ -132,6 +160,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand All @@ -143,6 +175,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand All @@ -154,6 +190,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand All @@ -165,6 +205,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
<optional>true</optional>
</dependency>
Expand All @@ -177,6 +221,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
<exclusion>
<artifactId>cglib</artifactId>
<groupId>*</groupId>
Expand Down Expand Up @@ -212,6 +260,10 @@
<artifactId>log4j-to-slf4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>ch.qos.logback</groupId>
</exclusion>
</exclusions>
</dependency>
</dependencies>
Expand Down
Loading
Loading