Vulnerability in Log4j 2.52.2 And Older on Siteminder Application Server Agents (ASA)
Article ID: 427360
Updated On:
Products
Issue/Introduction
A number of vulnerabilities have been published for Apache Log4J version 2 impacting Log4j2 2.0-beta9 through to 2.25.2
Siteminder bundles Apache Log4J2 in a number of components, including Siteminder ASA Agents
Log4J by Siteminder ASA Agent Version:
r12.7: Log4j 2.10.0
r12.8: Log4j 2.10.0
Environment
PRODUCT: Siteminder
COMPONENT: Application Server Agents (ASA)
VERSION: 12.7; 12.8
OPERATING SYSTEM: Any
Cause
The following CVE has been published for log4J impacting all versions of Log4J 2.25.2 and older.
CVE-2025-68161 "Apache Log4j Core: Missing TLS hostname verification in Socket appender"
IMPACT: Medium
DESCRIPTION: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true. This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions: * The attacker is able to intercept or redirect network traffic between the client and the log receiver. * The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured). Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue. As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.
IMPACTED: Log4J 2.0.1 - 2.25.2
REMDIATED: Log4J 2.25.3
Resolution
Update Log4J on the Siteminder ASA Agent to Log4J 2.25.3
1) Download Log4J 2.25.3 from this KB
SiteMinder Agent for Oracle WebLogic Server 12.7 and 12.8
1) Stop WebLogic application server.
2) Navigate to <wl_installation_path>/wlserver/server/lib and take a backup of the existing log4j jars:
log4j-core-<existing_version>.jar
log4j-api-<existing_version>.jar
3) Navigate to the bin folder for the domain created in WebLogic application server.
4) Take a backup of the startWebLogic.cmd/startWebLogic.sh file.
5) Open the existing startWebLogic.cmd/startWebLogic.sh file, and update the existing log4j version to the 2.17.1 version in the following values of the SMASA_CLASSPATH
log4j-api-<existing_version>.jar
log4j-core-<existing_version>.jar
Example:
log4j-api-2.25.3.jar and log4j-core-2.25.3.jar
6) Save the changes.
7) Start WebLogic application server.
SiteMinder Agent for IBM WebSphere 12.8
IBM WebSphere for Liberty
1) Stop WebSphere application server.
2) Navigate to <installation_path>/usr/servers/lib/global/
3) Take a backup of the following log4j files and then delete the original files:
log4j-api-<version>.jar
log4j-core-<version>.jar
d) Place the following new log4j files in this location:
<installation_path>/usr/servers/lib/global/log4j-api-2.25.3.jar
<installation_path>/usr/servers/lib/global/log4j-core-2.25.3.jar
4) Start WebSphere application server.
IBM WebSphere
1) Stop WebSphere application server.
2) Navigate to <websphere_home>/lib/ext/
3) Take a backup of the following log4j files and then delete the original files:
log4j-api-<existing_version>.jar
log4j-core-<existing_version>.jar
4) Place the following new log4j files in this location:
<websphere_home>/lib/ext/log4j-api-2.25.3.jar
<websphere_home>/lib/ext/log4j-core-2.25.3.jar
5) Start WebSphere application server.
Additional Information
427360 Vulnerability in Log4j 2.52.2 And Older on Siteminder Application Server Agents (ASA)
427325 Vulnerability in Log4j 2.52.2 And Older on the Siteminder Policy Server
427312 Vulnerability in Log4j 2.52.2 And Older on Siteminder Access Gateway
427357 Vulnerability in Log4j 2.52.2 And Older on Siteminder SDK
427332 Vulnerability in Log4j 2.52.2 And Older on Siteminder AdminUI
CVE-2025-68161
CVE-2021-44228
CVE-2021-45046
CVE-2021-45105
CVE-2021-44832
CVE-2021-4104
Attachments
Feedback
