0

I have downloaded Eclispe 4.16 version zip file and using this to create UFT developer Maven project with TestNG framework. I have observed that log4j-core-2.8.2 is getting created in C:\eclipse\configuration\org.eclipse.osgi\455\0.cp\lib folder. This log4J version is vulnerable as per my understanding. If i delete this 455 folder then This folder(455)getting created automatically after opening eclipse Please could you suggest how to remove this Log4J version or update to Log4J2.17 version ? My organization asked me remove this Log4J 2.8.2 from drive

NOTE: I am working on UFT Developer project which supports only eclipse 4.16(2020-06) or earlier version Thanks Devkant

Devkant Krishnatrey
  • 69
  • 1
  • 1
  • 9
  • 2
    Why Eclipse 4.16? The current version of Eclipse is 4.22 (2021-12) – greg-449 Jan 21 '22 at 11:52
  • 1
    Can you execute `bundle 455` in an OSGI console and add the information to the question? You can open an OSGI console from the Console view. – Piotr P. Karwasz Jan 21 '22 at 11:53
  • That location is a temporary location where plug-in contents are unpacked, you need to identify the problem plug-in using the `bundle 455` OSGi command as mentioned in the previous comment. – greg-449 Jan 21 '22 at 11:58
  • First using such old software (4.16?) instead of an uptodate one is the basic issue here. The log4j version is old yes and vulnerable. Apart from that you should check the CVE's which describe the scenarios.. Try to remove things instead of updating to more recent versions is there real problem here... – khmarbaise Jan 21 '22 at 12:13
  • Thanks @PiotrP.Karwasz and Greg for looking into. I am not much expert in java and eclipse too. Please could you guide me on how to open OSGI console and run the required command Thanks in advance – Devkant Krishnatrey Jan 21 '22 at 12:29
  • In the Console view, click on the Open Console icon at the top right, select "Host OSGi Console". You get a command line style console where you can type commands – greg-449 Jan 21 '22 at 13:12
  • I can only see three options to select 1.New Console View 2. Java Stack Trace Console and 3. Maven Console .. Please uggest – Devkant Krishnatrey Jan 21 '22 at 13:17
  • Whether log4j-core-2.8.2 is vulnerable or not depends on the scenario (the question is, how can an attacker from the outside trigger a message to be logged here?). The first thing you should do is update Eclipse and all installed plugins. What is the benefit of finding out the causing plugin in order to update it, when updating the plugin might also require updating all the other parts? – howlger Jan 21 '22 at 13:42
  • @greg-449 The bug report is about Log4j 1.x, so I guess it is unrelated to the `log4j-core-2.8.2` of the question. – howlger Jan 21 '22 at 14:44
  • Alternatively to the OSGi console, you might use the [Log4-detector](https://github.com/mergebase/log4j-detector) to find the plugin JAR, that contains the `log4j-core-2.8.2.jar`. – howlger Jan 21 '22 at 14:46
  • I have updated more details in original query to answer why am i using eclipse 4.16 version – Devkant Krishnatrey Jan 22 '22 at 12:42
  • @greg-449 i tried using below command too but it does not prompt osgi console.. java -jar org.eclipse.osgi_3.15.300.v20200520-1959.jar -console Can you please help ? its bit urgent – Devkant Krishnatrey Jan 22 '22 at 13:05
  • If you look in the 455/0/.cp folder is there a MANIFEST.MF in a META-INF directory? The plug-in name will be in that (the `Bundle-SymbolicName`). But note that there is no way to update old plugins other than moving to a newer Eclipse – greg-449 Jan 22 '22 at 13:32
  • @greg-449 there is no file like under /.cp folder.. Please suggest.. Also , just to add , i am able to open OSGI console via command prompt but command "bundle 455" does not return anything on command prompt. please suggest – Devkant Krishnatrey Jan 22 '22 at 14:06

0 Answers0