http://coldfusion.com logo
Join Slack
Powered by
I have a security/version question related to Luce...
# lucee
e
I have a security/version question related to Lucee and Log4j (i've read various discussion forums and realize the big log4j issues from a little bit ago did not affect lucee's implementation but have a blanket upgrade request from clients security team) MORE
SETUP Currently running Lucee 5.3.8.189 on Linux Received this message from client security
Copy code
The technology `Apache Log4j` version `1.2.17` associated with the library `log4j:log4j` found in `/opt/lucee/tomcat/lucee-server/felix-cache/bundle23/version0.0/bundle.jar -\u003e META-INF/maven/log4j/log4j` has been End-of-Life since `2015-08-05`.
Security team is asking to update the Apache Log4j from 1.2.17 to 2.3.2 I see from forums that Lucee 5.3.9.133 updated to log4j2 (version 2.17.2) My questions are: 1. If i upgrade to 5.3.9.133 can I upgrade log4j from 2.17.2 to 2.3.2? (and what is that process?) 2. Is there a better lucee version i should consider? (yes that is rather open ended i know, but am looking to minimize the amount of regression and testing involved)
q
5.4.6.9 is what you really should be targeting. That would be the last of the 5.x train and is an LTS release. That being said, 6.2 was just published, so the 5.x train is just about done. You should put it on your short-term roadmap to get upgraded when possible.
💯 1
z
go for 6.2, the performance improvements alone in terms of speed and memory usage are great IMHO don't waste time on any intermediate upgrades, you'll just be battling tech debt which we probably already have solved 5.3.8.189 isn't even the latest 5.3.8 release, in the short term, you should quickly upgrade to 5.3.8.237
e
thanks for the input, appreciate it!
Open in Slack
PreviousNext
Powered by