Vulnerability in Log4j 2.25.3 and Older on Siteminder Access Gateway
Article ID: 438208
Updated On:
Products
Issue/Introduction
A number of vulnerabilities have been published for Apache Log4J version 2 impacting Log4j2 2.0-beta9 through to 2.25.3
Siteminder bundles Apache Log4J2 in a number of components, including Siteminder Access Gateway.
Log4J by Siteminder Version:
r12.8.7: Log4j 2.17.2
r12.8.8: Log4j 2.20.0
r12.8.8.1: Log4j 2.20.0
r12.9: Log4j 2.20.0
Log4j 2.25.3 was delivered in a series of component specific KB's.
This KB will allow you to upgrade Log4J on the Siteminder Access Gateway Server to Log4J 2.25.4
Environment
PRODUCT: Siteminder
COMPONENT: Access Gateway Server
VERSION: 12.8.7; 12.8.8; 12.8.81; 12.9
OPERATING SYSTEM: Any
Cause
The following CVE has been published for log4J impacting all versions of Log4J 2.25.3 and older.
CVE-2026-34481 "Improper serialization of non-finite floating-point values in JsonTemplateLayout"
IMPACT: Medium
DESCRIPTION: Apache Log4j’s JsonTemplateLayout, in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records.
IMPACTED: Log4J 2.25.3 and older
REMDIATED: Log4J 2.25.4
CVE-2026-34480 "Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters"
IMPACT: Medium
DESCRIPTION: Apache Log4j Core’s XmlLayout, in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification producing invalid XML output whenever a log message or MDC value contains such characters.
IMPACTED: Log4J 2.25.3 and older
REMDIATED: Log4J 2.25.4
CVE-2026-34479 "Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters"
IMPACT: Medium
DESCRIPTION: The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.
IMPACTED: Log4J 2.25.3 and older
REMDIATED: Log4J 2.25.4
CVE-2026-34478 "Log injection in Rfc5424Layout due to silent configuration incompatibility"
IMPACT: Medium
DESCRIPTION: Apache Log4j Core’s Rfc5424Layout, in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.
IMPACTED: Log4J 2.25.3 and older
REMDIATED: Log4J 2.25.4
CVE-2026-34477 "verifyHostName attribute silently ignored in TLS configuration"
IMPACT: Medium
DESCRIPTION: The fix for CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName attribute of the <Ssl> element.
IMPACTED: Log4J 2.25.3 and older
REMDIATED: Log4J 2.25.4
Resolution
Update Log4J Siteminder Access Gateway to Log4J 2.25.4
1) Download Log4J "log4j-2.25.4.zip" from this KB
2) Logon to the Access Gateway host and backup the log4j files from the following locations:
<Install_Dir>\CA\secure-proxy\Tomcat\thirdparty\log4j-api-2.xx.x.jar
<Install_Dir>\CA\secure-proxy\Tomcat\thirdparty\log4j-core-2.xx.x.jar
<Install_Dir>\CA\secure-proxy\Tomcat\thirdparty\log4j-slf4j-impl-2.xx.x.jar
OR
<Install_Dir>\CA\secure-proxy\Tomcat\thirdparty\log4j-slf4j2-impl-2.xx.x.jar
<Install_Dir>\CA\secure-proxy\Tomcat\webapps\CA_AuthAZ\WEB-INF\lib\log4j-api-2.xx.x.jar
<Install_Dir>\CA\secure-proxy\Tomcat\webapps\CA_AuthAZ\WEB-INF\lib\log4j-core-2.xx.x.jar
<Install_Dir>\CA\secure-proxy\Tomcat\webapps\CA_AuthAZ\WEB-INF\lib\log4j-web-2.xx.x.jar
<Install_Dir>\CA\secure-proxy\Tomcat\webapps\CA_AuthAZ\WEB-INF\lib\log4j-slf4j-impl-2.xx.x.jar
OR
<Install_Dir>\CA\secure-proxy\Tomcat\webapps\CA_AuthAZ\WEB-INF\lib\log4j-slf4j2-impl-2.xx.x.jar
<Install_Dir>\CA\secure-proxy\Tomcat\webapps\chs\WEB-INF\lib\log4j-web-2.xx.x.jar
<Install_Dir>\CA\secure-proxy\Tomcat\webapps\sessionassuranceapp\WEB-INF\lib\log4j-web-2.xx.x.jar
<Install_Dir>\CA\secure-proxy\Tomcat\webapps\proxyui\WEB-INF\lib\log4j-web-2.xx.x.jar
3) Stop Access Gateway.
4) Delete the log4j files from the paths listed (above)
5) Place the new jars in the following locations:
<Install_Dir>\CA\secure-proxy\Tomcat\thirdparty\log4j-api-2.25.4.jar
<Install_Dir>\CA\secure-proxy\Tomcat\thirdparty\log4j-core-2.25.4.jar
<Install_Dir>\CA\secure-proxy\Tomcat\thirdparty\log4j-slf4j2-impl-2.25.4.jar
<Install_Dir>\CA\secure-proxy\Tomcat\webapps\CA_AuthAZ\WEB-INF\lib\log4j-api-2.25.4.jar
<Install_Dir>\CA\secure-proxy\Tomcat\webapps\CA_AuthAZ\WEB-INF\lib\log4j-core-2.25.4.jar
<Install_Dir>\CA\secure-proxy\Tomcat\webapps\CA_AuthAZ\WEB-INF\lib\log4j-slf4j2-impl-2.25.4.jar
<Install_Dir>\CA\secure-proxy\Tomcat\webapps\CA_AuthAZ\WEB-INF\lib\log4j-web-2.25.4.jar
<Install_Dir>\CA\secure-proxy\Tomcat\webapps\chs\WEB-INF\lib\log4j-web-2.25.4.jar
<Install_Dir>\CA\secure-proxy\Tomcat\webapps\sessionassuranceapp\WEB-INF\lib\log4j-web-2.25.4.jar
<Install_Dir>\CA\secure-proxy\Tomcat\webapps\proxyui\WEB-INF\lib\log4j-web-2.25.4.jar
6) Start Access Gateway.
Additional Information
Apache.org Vulnerabilities in Logging Services
CVE-2026-34481
CVE-2026-34480
CVE-2026-34479
CVE-2026-34478
CVE-2026-34477
CVE-2025-68161
CVE-2021-44228
CVE-2021-45046
CVE-2021-45105
CVE-2021-44832
CVE-2021-4104
Attachments
Feedback
