cfml

<@U01EY27APNH> The CVE linked on the <https://helpx.adobe.com/security/products/coldfusion/apsb22-22.html|Adobe security bulletin> appears to point to a DJango CVE (A Python library).  Can you explain?
<https://nvd.nist.gov/vuln/detail/CVE-2022-22818>

Note, that wasn't directly linked to, I just googled the CVE number

<@U0BJDA84R> can you take a look here? Thanks for the heads up Brad.

<@U06V253M4> yeah I did wonder about that. You had more luck finding a useful link for `CVE-2022-22818` than I did.

I think the punch line of that (ignorant me talking here) is this: <https://cwe.mitre.org/data/definitions/79.html>

That's a generic concern about incoming request data getting echoed back to the page.

CSS CVEs in CF usually are for the admin UI or for something like the CKEditor/CFAjax which are features that output HTML/JS to the client.

At first, I assumed this update was finally the removal of log4j 1.x (which Lucee has now released in their recent 5.3.9 stable version)

Oh weird, this update does include log4j.  It says that here
<https://helpx.adobe.com/coldfusion/kb/coldfusion-2021-update-4.html>
but this page mentions nothing about it which is what I read first
<https://helpx.adobe.com/coldfusion/kb/coldfusion-2021-updates.html>

<@U0BJDA84R> Maybe you can mention the Log4j and Tomcat updates in that second link

I'm seeing that some folks are still seeing some log4j 1.x files though so I'm not sure what's up regarding that...

Hopefully, if they are truly no longer in use, the fix will be to just manually remove them for now

I can confirm that deleting the Log4j 1.x jars from ACF 2018 renders the server unbootable

```Error [main] - Unable to initialise Security service: java.lang.NoClassDefFoundError: org/apache/log4j/Logger
Information [main] - Unable to initialise CFStartupServlet:org/apache/log4j/Logger
[ERROR] coldfusion.server.ServiceFactory$ServiceNotAvailableException: The Runtime service is not available.```

Yeah but Brad the server is not *vulnerable* any more mate. Mark _did_ say this was just a security update.

I honestly can't tell if you're just being sarcastic or not...

The technote says log4j has been updated to version 2.17.2.  So if that's not true, let's at least change the documentation so it matches reality.

I'm well aware of the existing mitigation Adobe has already done to the Log4j 1.x jars.  I'm also well aware of my several government clients who don't care about that :slightly_smiling_face:

Escalating this.
Also, I always assume Adam is taking the piss basically in any post he does that mentions me. Keeps me from getting my feelings hurt. :wink: