Vulnerability in Log4j 2.25.3 And Older on Siteminder SDK

Products

• SITEMINDER

Issue/Introduction

A number of vulnerabilities have been published for Apache Log4J version 2 impacting Log4j2 2.0-beta9 through to 2.25.3

Siteminder bundles Apache Log4J2 in a number of components, including Siteminder SDK.

Log4J by Siteminder Version:

r12.8.7:    Log4j 2.17.2
r12.8.8:    Log4j 2.20.0
r12.8.8.1: Log4j 2.20.0
r12.9:       Log4j 2.20.0

Log4j 2.25.3 was delivered in a series of component specific KB's.

This KB will allow you to upgrade Log4J on the Siteminder SDKI to Log4J 2.25.4

Environment

PRODUCT: Siteminder

COMPONENT: SDK

VERSION: 12.8.7; 12.8.8; 12.8.81; 12.9

OPERATING SYSTEM: An

Cause

The following CVE has been published for log4J impacting all versions of Log4J 2.25.3 and older.

 

CVE-2026-34481  "Improper serialization of non-finite floating-point values in JsonTemplateLayout"

IMPACT:  Medium

DESCRIPTION: Apache Log4j’s JsonTemplateLayout, in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records.

IMPACTED: Log4J 2.25.3 and older

REMDIATED:  Log4J 2.25.4

CVE-2026-34480  "Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters"

IMPACT:  Medium

DESCRIPTION: Apache Log4j Core’s XmlLayout, in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification producing invalid XML output whenever a log message or MDC value contains such characters.

IMPACTED: Log4J 2.25.3 and older

REMDIATED:  Log4J 2.25.4

CVE-2026-34479  "Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters"

IMPACT:  Medium

DESCRIPTION: The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.

IMPACTED: Log4J 2.25.3 and older

REMDIATED:  Log4J 2.25.4

CVE-2026-34478  "Log injection in Rfc5424Layout due to silent configuration incompatibility"

IMPACT:  Medium

DESCRIPTION: Apache Log4j Core’s Rfc5424Layout, in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.

IMPACTED: Log4J 2.25.3 and older

REMDIATED:  Log4J 2.25.4

CVE-2026-34477  "verifyHostName attribute silently ignored in TLS configuration"

IMPACT:  Medium

DESCRIPTION: The fix for CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName attribute of the <Ssl> element.

IMPACTED: Log4J 2.25.3 and older

REMDIATED:  Log4J 2.25.4

Resolution

Update Log4J for the Siteminder SDK to Log4J 2.25.4

1) Download  "log4j-2.25.4.zip" from this KB

2) Backup of the existing Log4j2 files in your environment from the following locations:

<sdk_installation_path>\java\log4j-api-2.xx.x.jar
<sdk_installation_path>\java\log4j-core-2.xx.x.jar
<sdk_installation_path>\java\log4j-slf4j-impl-2.xx.x17.1.jar
OR
<sdk_installation_path>\java\log4j-slf4j2-impl-2.xx.x17.1.jar

3) Delete the existing log4j files from the above-mentioned location.

4) Copy the Log4j 2.25.4 files to the server and place the new jars in the following location:

<sdk_installation_path>\java\log4j-api-2.25.4 .jar
<sdk_installation_path>\java\log4j-core-2.25.4 .jar
<sdk_installation_path>\java\log4j-slf4j2-impl-2.25.4.jar

5) Update all the references of the existing 2.x log4j version with the 2.25.4  version in the class path parameter of all the custom applications that are built using SDK, and save the changes.

6) Restart the custom applications.

Additional Information

Apache.org Vulnerabilities in Logging Services

CVE-2026-34481
CVE-2026-34480
CVE-2026-34479
CVE-2026-34478
CVE-2026-34477
CVE-2025-68161
CVE-2021-44228
CVE-2021-45046
CVE-2021-45105
CVE-2021-44832
CVE-2021-4104