Vulnerability in Log4j 2.25.3 And Older on Siteminder AdminUI

Products

• SITEMINDER

Issue/Introduction

A number of vulnerabilities have been published for Apache Log4J version 2 impacting Log4j2 2.0-beta9 through to 2.25.3

Siteminder bundles Apache Log4J2 in a number of components, including the Siteminder AdminUI

Log4J by Siteminder Version:

r12.8.7:    Log4j 2.17.2
r12.8.8:    Log4j 2.20.0
r12.8.8.1: Log4j 2.20.0
r12.9:       Log4j 2.20.0

Log4j 2.25.3 was delivered in a series of component specific KB's.

This KB will allow you to upgrade Log4J on the Siteminder AdminUI to Log4J 2.25.4

Environment

PRODUCT: Siteminder

COMPONENT: AdminUI

VERSION: 12.8.7; 12.8.8; 12.8.81; 12.9

OPERATING SYSTEM: Any

Cause

The following CVE has been published for log4J impacting all versions of Log4J 2.25.3 and older.

 

CVE-2026-34481  "Improper serialization of non-finite floating-point values in JsonTemplateLayout"

IMPACT:  Medium

DESCRIPTION: Apache Log4j’s JsonTemplateLayout, in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records.

IMPACTED: Log4J 2.25.3 and older

REMDIATED:  Log4J 2.25.4

CVE-2026-34480  "Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters"

IMPACT:  Medium

DESCRIPTION: Apache Log4j Core’s XmlLayout, in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification producing invalid XML output whenever a log message or MDC value contains such characters.

IMPACTED: Log4J 2.25.3 and older

REMDIATED:  Log4J 2.25.4

CVE-2026-34479  "Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters"

IMPACT:  Medium

DESCRIPTION: The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.

IMPACTED: Log4J 2.25.3 and older

REMDIATED:  Log4J 2.25.4

CVE-2026-34478  "Log injection in Rfc5424Layout due to silent configuration incompatibility"

IMPACT:  Medium

DESCRIPTION: Apache Log4j Core’s Rfc5424Layout, in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.

IMPACTED: Log4J 2.25.3 and older

REMDIATED:  Log4J 2.25.4

CVE-2026-34477  "verifyHostName attribute silently ignored in TLS configuration"

IMPACT:  Medium

DESCRIPTION: The fix for CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName attribute of the <Ssl> element.

IMPACTED: Log4J 2.25.3 and older

REMDIATED:  Log4J 2.25.4

Resolution

Update Log4J Siteminder AdminUI to Log4J 2.25.4

1) Download Log4J "log4j-2.25.4.zip" from this KB

2) Logon to the Siteminder AdminUI host and back-up the following files (Any log4j files 2.25.3 and older)

<adminui_installation_path>\standalone\deployments\iam_siteminder.ear\sso-restapi-services.war\WEB-INF\lib\log4j-api-<existing_version>.jar
<adminui_installation_path>\standalone\deployments\iam_siteminder.ear\sso-restapi-services.war\WEB-INF\lib\log4j-core-<existing_version>.jar
<adminui_installation_path>\standalone\deployments\iam_siteminder.ear\sso-restapi-services.war\WEB-INF\lib\log4j-slf4j-impl-<existing_version>.jar
OR
<adminui_installation_path>\standalone\deployments\iam_siteminder.ear\library\log4j-core-<existing_version>.jar
OR
<adminui_installation_path>\standalone\deployments\iam_siteminder.ear\sso-restapi-services.war\WEB-INF\lib\log4j-slf4j2-impl-<existing_version>.jar

<adminui_installation_path>\adminui\standalone\deployments\iam_siteminder.ear\sso-security-services.war\WEB-INF\lib\log4j-api-<existing_version>.jar
<adminui_installation_path>\adminui\standalone\deployments\iam_siteminder.ear\sso-security-services.war\WEB-INF\lib\log4j-core-<existing_version>.jar
<adminui_installation_path>\adminui\standalone\deployments\iam_siteminder.ear\sso-security-services.war\WEB-INF\lib\log4j-slf4j-impl-<existing_version>.jar
OR
<adminui_installation_path>\adminui\standalone\deployments\iam_siteminder.ear\sso-security-services.war\WEB-INF\lib\log4j-slf4j2-impl-<existing_version>.jar

3) Stop Administrative UI.

4) Delete the existing log4j jar files (Listed in Step #2)

NOTE: DO NOT delete the "module.xml" files.

5)  Copy the updated log4j2 files into the following directories:

<adminui_installation_path>\standalone\deployments\iam_siteminder.ear\sso-restapi-services.war\WEB-INF\lib\log4j-api-2.25.4.jar
<adminui_installation_path>\standalone\deployments\iam_siteminder.ear\sso-restapi-services.war\WEB-INF\lib\log4j-core-2.25.4.jar
<adminui_installation_path>\standalone\deployments\iam_siteminder.ear\sso-restapi-services.war\WEB-INF\lib\log4j-slf4j2-impl-2.25.4.jar
<adminui_installation_path>\standalone\deployments\iam_siteminder.ear\library\log4j-core-<existing_version>.jar

<adminui_installation_path>\adminui\standalone\deployments\iam_siteminder.ear\sso-security-services.war\WEB-INF\lib\log4j-api-2.25.4.jar
<adminui_installation_path>\adminui\standalone\deployments\iam_siteminder.ear\sso-security-services.war\WEB-INF\lib\log4j-core-2.25.4.jar
<adminui_installation_path>\adminui\standalone\deployments\iam_siteminder.ear\sso-security-services.war\WEB-INF\lib\log4j-slf4j2-impl-2.25.4.jar

<adminui_installation_path>\adminui\modules\com\ca\iam\log4j2\api\main\log4j-api-2.25.4.jar
<adminui_installation_path>\adminui\modules\com\ca\iam\log4j2\core\main\log4j-core-2.25.4.jar

6) Modify the 'module.xml' file in the following directories, pointing to the new 'log4j' file names

<adminui_installation_path>\modules\com\ca\iam\log4j2\api\main\module.xml
<adminui_installation_path>\modules\com\ca\iam\log4j2\core\main\module.xml

EXAMPLE:

    <resources>
        <resource-root path="log4j-api-2.25.4.jar"/>
    </resources>

7) Start the AdminUI

Additional Information

Apache.org Vulnerabilities in Logging Services

CVE-2026-34481
CVE-2026-34480
CVE-2026-34479
CVE-2026-34478
CVE-2026-34477
CVE-2025-68161
CVE-2021-44228
CVE-2021-45046
CVE-2021-45105
CVE-2021-44832
CVE-2021-4104