How to tell which third-party Java libraries are using Log4j 1.x?

787 Views Asked by At

To address CVE-2019-17571 flagged by a client I'm trying to upgrade Log4j 1.2.x used within our jfreechart-based Rails application to Log4j 2 (following the instructions here). However, I couldn't tell which Java library is still using the old Log4j 1.x imports. Here's the error I'm seeing in Rails log (the Java charting application is loaded via RJB):

$ tail -f production_log.2020-03-29

FATAL 2020-03-29 16:58:49 30512 NoClassDefFoundError (org/apache/log4j/Logger):
  lib/chart_interface.rb:24:in 'method_missing'
  lib/chart_interface.rb:24:in 'createChart'
  app/controllers/dash_controller.rb:565:in 'resources_info'

Is this a good way to find out which third-party Java libraries are using the old Log4j 1.x imports?

$ ls -ltr
total 8756
-rw-r----- 1 root  ainet  391430 Oct  5 02:16 log4j-1.2.15.jar.old
-rwxr-x--- 1 root  ainet 1801249 Mar 26 03:15 wig.jar
-rwxr-x--- 1 root  ainet  288911 Mar 26 03:15 tcommon-2.1.jar
-rwxr-x--- 1 root  ainet  657841 Mar 26 03:15 postgresql-9.4-1202.jdbc42.jar
-rwxr-x--- 1 root  ainet 1702810 Mar 26 03:15 log4j-core-2.13.1.jar
-rwxr-x--- 1 root  ainet  292243 Mar 26 03:15 log4j-api-2.13.1.jar
-rwxr-x--- 1 root  ainet 1425744 Mar 26 03:15 jfreechart-1.0.13.jar
-rwxr-x--- 1 root  ainet   62103 Mar 26 03:15 commons-pool-1.3.jar
-rwxr-x--- 1 root  ainet  121757 Mar 26 03:15 commons-dbcp-1.2.2.jar
-rw-r--r-- 1 ainet ainet  330507 Mar 26 03:50 jcommon-1.0.24.jar

$ grep -R apache\.log4j
Binary file log4j-1.2.15.jar.old matches

The only hit was in the old jar file and yet RJB is complaining about NoClassDefFoundError.

0

There are 0 best solutions below