Vulnerability in Log4j 2.25.3 And Older on the Siteminder Policy Server

Products

• SITEMINDER

Issue/Introduction

A number of vulnerabilities have been published for Apache Log4J version 2 impacting Log4j2 2.0-beta9 through to 2.25.3

Siteminder bundles Apache Log4J2 in a number of components, including the Siteminder Policy Server.  

Log4J by Siteminder Version:

r12.8.7:    Log4j 2.17.2
r12.8.8:    Log4j 2.20.0
r12.8.8.1: Log4j 2.20.0
r12.9:       Log4j 2.20.0

Log4j 2.25.3 was delivered in a series of component specific KB's.

This KB will allow you to upgrade Log4J on the Siteminder Policy Server to Log4J 2.25.4

 

 

Environment

PRODUCT: Siteminder

COMPONENT: Policy Server

VERSION: 12.8.7; 12.8.8; 12.8.81; 12.9

OPERATING SYSTEM: Any

Cause

The following CVE has been published for log4J impacting all versions of Log4J 2.25.3 and older.

 

CVE-2026-34481  "Improper serialization of non-finite floating-point values in JsonTemplateLayout"

IMPACT:  Medium

DESCRIPTION: Apache Log4j’s JsonTemplateLayout, in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records.

IMPACTED: Log4J 2.25.3 and older

REMDIATED:  Log4J 2.25.4

CVE-2026-34480  "Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters"

IMPACT:  Medium

DESCRIPTION: Apache Log4j Core’s XmlLayout, in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification producing invalid XML output whenever a log message or MDC value contains such characters.

IMPACTED: Log4J 2.25.3 and older

REMDIATED:  Log4J 2.25.4

CVE-2026-34479  "Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters"

IMPACT:  Medium

DESCRIPTION: The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.

IMPACTED: Log4J 2.25.3 and older

REMDIATED:  Log4J 2.25.4

CVE-2026-34478  "Log injection in Rfc5424Layout due to silent configuration incompatibility"

IMPACT:  Medium

DESCRIPTION: Apache Log4j Core’s Rfc5424Layout, in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.

IMPACTED: Log4J 2.25.3 and older

REMDIATED:  Log4J 2.25.4

CVE-2026-34477  "verifyHostName attribute silently ignored in TLS configuration"

IMPACT:  Medium

DESCRIPTION: The fix for CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName attribute of the <Ssl> element.

IMPACTED: Log4J 2.25.3 and older

REMDIATED:  Log4J 2.25.4

Resolution

Update Log4J the Siteminder Policy Server to Log4J 2.25.4

1) Download "log4j-2.25.4.zip" from this KB

2) Back-up the following files

<siteminder_install_Dir>\siteminder\bin\thirdparty\log4j-api-2.xx.x.jar
<siteminder_install_Dir>\siteminder\bin\thirdparty\log4j-core-2.xx.x.jar
<siteminder_install_Dir>\siteminder\bin\thirdparty\log4j-slf4j-impl-2.xx.x.jar
OR
<siteminder_install_Dir>\siteminder\bin\thirdparty\log4j-slf4j2-impl-2.xx.x.jar

<siteminder_install_Dir>\siteminder\bin\jars\log4j-api-2.xx.x.jar
<siteminder_install_Dir>\siteminder\bin\jars\log4j-core-2.xx.x.jar
<siteminder_install_Dir>\siteminder\bin\jars\log4j-slf4j-impl-2.xx.x.jar
OR
<siteminder_install_Dir>\siteminder\bin\jars\log4j-slf4j2-impl-2.xx.x.jar

3) Stop the Policy Server

4) Delete the existing log4j jar files (Listed in Step #2)

5) Place the new log4j 2.25.4 jars in the following locations:

<siteminder_install_Dir>\siteminder\bin\thirdparty\log4j-api-2.25.4.jar
<siteminder_install_Dir>\siteminder\bin\thirdparty\log4j-core-2.25.4.jar
<siteminder_install_Dir>\siteminder\bin\thirdparty\log4j-slf4j2-impl-2.25.4.jar

<siteminder_install_Dir>\siteminder\bin\jars\log4j-api-2.25.4.jar
<siteminder_install_Dir>\siteminder\bin\jars\log4j-core-2.25.4.jar
<siteminder_install_Dir>\siteminder\bin\jars\log4j-slf4j2-impl-2.25.4.jar

6) After copying the log4j jars into the <siteminder_install_Dir>\siteminder\bin\jars\ folder (as described in step #5), rename the jar file,  removing version from the filenames.

RESULT:

<siteminder_install_Dir>\siteminder\bin\jars\log4j-api.jar
<siteminder_install_Dir>\siteminder\bin\jars\log4j-core.jar
<siteminder_install_Dir>\siteminder\bin\jars\log4j-slf4j2-impl-2.25.4.jar

NOTE: This step is only done to the files in the \jars directory.  NOT the \thirdparty directory.

7) Edit the JVMOptions.txt file at <siteminder_install_Dir>\siteminder\config\, update all the references of the existing log4j versions with the 2.25.4 version in the -Djava.class.path parameter, and save the changes.

EXAMPLE:

-Djava.class.path=<siteminder_install_Dir>/siteminder/resources;<siteminder_install_Dir>/siteminder/config/properties;<siteminder_install_Dir>/siteminder/bin/endorsed/jakarta.xml.bind-api.jar;<siteminder_install_Dir>/siteminder/bin/endorsed/jakarta.activation.jar;<siteminder_install_Dir>/siteminder/bin/jars/smbootstrap.jar;<siteminder_install_Dir>/siteminder/bin/thirdparty/log4j-api-2.25.4.jar;<siteminder_install_Dir>/siteminder/bin/thirdparty/log4j-core-2.25.4.jar;<siteminder_install_Dir>/siteminder/bin/thirdparty/log4j-slf4j2-impl-2.25.4.jar

8) Navigate to <siteminder_installation_home>/siteminder/bin, and edit the following scripts, updating all the references of the existing log4j versions:

smkeytool.bat/smkeytool.sh
smfedexport.bat/smfedexport.sh
smfedimport.bat/smfedimport.sh

EXAMPLE: 

set CLASSPATH=%SMFED_JARS%\smfedimport.jar;%SMFED_JARS%\saml2.jar;%SMFED_JARS%\saml2Metadata.jar;%SMFED_JARS%\saml2MetadataGen.jar;%SMFED_JARS%\wsgen.jar;%SMFED_JARS%\saml2Gen.jar;%SMFED_JARS%\SmJavaApi.jar;%SMFED_JARS%\fedutil.jar;%SMFED_JARS%\smkeydatabase.jar;%NETE_HSM_HOME%\JSP\lib\LunaProvider.jar;%SMFED_JARS%\smadminapi.jar;%SMFED_JARS%\smrpc.jar;%SMFED_JARS%\util-signed.jar;%SMFED_JARS%\tmsigservice.jar;%SMFED_JARS%\saml2security.jar;%SMFED_TPJARS%\xercesImpl.jar;%NETE_PS_ROOT%\config\properties;%SMFED_ENDORSED_JARS%\xmlsec-2.3.2.jar;%SMFED_TPJARS%\xml-apis.jar;%SMFED_TPJARS%\relaxngDatatype.jar;%SMFED_TPJARS%\commons-logging.jar;%SMFED_TPJARS%\commons-logging-api.jar;%SMFED_JARS%\smi18n.jar;%SMFED_JARS%\smagentapi.jar;%SMFED_TPJARS%\jvatk.jar;%SMFED_JARS%\smpkcs11.jar;%SMFED_JARS%\smcert.jar;%SMFED_JARS%\fipsmode.jar;%SMFED_JARS%\smcrypto.jar;%SMFED_TPJARS%\bc-fips-1.0.2.4.jar;%SMFED_TPJARS%\bcpkix-fips-1.0.7.jar;%SMFED_TPJARS%\log4j-core-2.25.4.jar;

9) Start Policy Server.

Additional Information

Apache.org Vulnerabilities in Logging Services

CVE-2026-34481
CVE-2026-34480
CVE-2026-34479
CVE-2026-34478
CVE-2026-34477
CVE-2025-68161
CVE-2021-44228
CVE-2021-45046
CVE-2021-45105
CVE-2021-44832
CVE-2021-4104