Vulnerability in Log4j 2.25.3 And Older on Siteminder Application Server Agents (ASA)
Article ID: 438214
Updated On:
Products
Issue/Introduction
A number of vulnerabilities have been published for Apache Log4J version 2 impacting Log4j2 2.0-beta9 through to 2.25.3
Siteminder bundles Apache Log4J2 in a number of components, including Siteminder ASA Agents
Log4J by Siteminder ASA Agent Version:
r12.7: Log4j 2.10.0
r12.8: Log4j 2.10.0
Log4j 2.25.3 was delivered in a series of component specific KB's.
This KB will allow you to upgrade Log4J on the Siteminder AdminUI to Log4J 2.25.4
Environment
PRODUCT: Siteminder
COMPONENT: Application Server Agents (ASA)
VERSION: 12.7; 12.8
OPERATING SYSTEM: Any
Cause
The following CVE has been published for log4J impacting all versions of Log4J 2.25.3 and older.
CVE-2026-34481 "Improper serialization of non-finite floating-point values in JsonTemplateLayout"
IMPACT: Medium
DESCRIPTION: Apache Log4j’s JsonTemplateLayout, in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records.
IMPACTED: Log4J 2.25.3 and older
REMDIATED: Log4J 2.25.4
CVE-2026-34480 "Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters"
IMPACT: Medium
DESCRIPTION: Apache Log4j Core’s XmlLayout, in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification producing invalid XML output whenever a log message or MDC value contains such characters.
IMPACTED: Log4J 2.25.3 and older
REMDIATED: Log4J 2.25.4
CVE-2026-34479 "Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters"
IMPACT: Medium
DESCRIPTION: The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.
IMPACTED: Log4J 2.25.3 and older
REMDIATED: Log4J 2.25.4
CVE-2026-34478 "Log injection in Rfc5424Layout due to silent configuration incompatibility"
IMPACT: Medium
DESCRIPTION: Apache Log4j Core’s Rfc5424Layout, in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.
IMPACTED: Log4J 2.25.3 and older
REMDIATED: Log4J 2.25.4
CVE-2026-34477 "verifyHostName attribute silently ignored in TLS configuration"
IMPACT: Medium
DESCRIPTION: The fix for CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName attribute of the <Ssl> element.
IMPACTED: Log4J 2.25.3 and older
REMDIATED: Log4J 2.25.4
Resolution
Update Log4J on the Siteminder ASA Agent to Log4J 2.25.4
1) Download Log4J "log4j-2.25.4.zip" from this KB
SiteMinder Agent for Oracle WebLogic Server 12.7 and 12.8
1) Stop WebLogic application server.
2) Navigate to <wl_installation_path>/wlserver/server/lib and take a backup of the existing log4j jars:
log4j-core-<existing_version>.jar
log4j-api-<existing_version>.jar
3) Navigate to the bin folder for the domain created in WebLogic application server.
4) Take a backup of the startWebLogic.cmd/startWebLogic.sh file.
5) Open the existing startWebLogic.cmd/startWebLogic.sh file, and update the existing log4j version to the 2.25.4 version in the following values of the SMASA_CLASSPATH
log4j-api-<existing_version>.jar
log4j-core-<existing_version>.jar
Example:
log4j-api-2.25.4.jar and log4j-core-2.25.4.jar
6) Save the changes.
7) Start WebLogic application server.
SiteMinder Agent for IBM WebSphere 12.8
IBM WebSphere for Liberty
1) Stop WebSphere application server.
2) Navigate to <installation_path>/usr/servers/lib/global/
3) Take a backup of the following log4j files and then delete the original files:
log4j-api-<version>.jar
log4j-core-<version>.jar
d) Place the following new log4j files in this location:
<installation_path>/usr/servers/lib/global/log4j-api-2.25.4.jar
<installation_path>/usr/servers/lib/global/log4j-core-2.25.4.jar
4) Start WebSphere application server.
IBM WebSphere
1) Stop WebSphere application server.
2) Navigate to <websphere_home>/lib/ext/
3) Take a backup of the following log4j files and then delete the original files:
log4j-api-<existing_version>.jar
log4j-core-<existing_version>.jar
4) Place the following new log4j files in this location:
<websphere_home>/lib/ext/log4j-api-2.25.4.jar
<websphere_home>/lib/ext/log4j-core-2.25.4.jar
5) Start WebSphere application server.
Additional Information
Apache.org Vulnerabilities in Logging Services
CVE-2026-34481
CVE-2026-34480
CVE-2026-34479
CVE-2026-34478
CVE-2026-34477
CVE-2025-68161
CVE-2021-44228
CVE-2021-45046
CVE-2021-45105
CVE-2021-44832
CVE-2021-4104
Attachments
Feedback
