From de19b051988705fbe2023ec4448877a46efbaa00 Mon Sep 17 00:00:00 2001
From: Kartheek Palla <palla.kartheekreddy@gmail.com>
Date: Wed, 22 Jul 2026 12:24:23 +0530
Subject: [PATCH] fix(security): remediate Log4Shell + EOL Jackson in neo4j
 transaction-event-handler

The neo4j-extensions/transaction-event-handler plugin bundled (compile scope)
log4j-core/api/1.2-api 2.8.2 and jackson-core/databind 2.7.4. The handler logs
attacker-influenceable graph property values (name, channel, arbitrary metadata)
through log4j2, so a crafted value such as ${jndi:ldap://.../x} reaching the graph
could trigger a JNDI lookup -> RCE inside the DB JVM (CVE-2021-44228 / Log4Shell).
Jackson 2.7.4 is years-EOL with known polymorphic-deserialization CVEs.

- Bump log4j-* 2.8.2 -> 2.17.1 (last line guaranteeing Java 8; fully closes the
  Log4Shell chain CVE-2021-44228/45046/45105/44832).
- Bump jackson-core/databind 2.7.4 -> 2.17.2 (Java-8 compatible).
- Introduce <log4j.version>/<jackson.version> properties so the artifacts stay
  in lockstep and regressions are easy to gate on.

Dependency-only change to an in-process DB plugin; payload/contract unchanged.
Module stays on Java 8 (Neo4j 3.0.4). Verified: `mvn dependency:tree` resolves
2.17.1/2.17.2 with no 2.8.2/2.7.4 remaining; module compiles under JDK 8. The
pre-existing TestNeo4JCluster integration failures are unchanged by this bump
(confirmed identical on the original versions).

Implements X1/X2 (Wave 0) from implementation-designs/knowledge-platform-db-extensions.md.
---
 .../transaction-event-handler/pom.xml            | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/neo4j-extensions/transaction-event-handler/pom.xml b/neo4j-extensions/transaction-event-handler/pom.xml
index fd5eb43..2336b10 100755
--- a/neo4j-extensions/transaction-event-handler/pom.xml
+++ b/neo4j-extensions/transaction-event-handler/pom.xml
@@ -9,33 +9,39 @@
 
 	<properties>
 		<neo4j.version>3.0.4</neo4j.version>
+		<!-- log4j 2.17.1 is the last line guaranteeing Java 8 and fully remediates the
+		     Log4Shell CVE chain (CVE-2021-44228/45046/45105/44832). Keep the three
+		     artifacts in lockstep via this property. -->
+		<log4j.version>2.17.1</log4j.version>
+		<!-- Jackson 2.17.x replaces the EOL 2.7.4 (polymorphic-deserialization CVEs); Java-8 compatible. -->
+		<jackson.version>2.17.2</jackson.version>
 	</properties>
 
 	<dependencies>
         <dependency>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-1.2-api</artifactId>
-            <version>2.8.2</version>
+            <version>${log4j.version}</version>
         </dependency>
         <dependency>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-api</artifactId>
-            <version>2.8.2</version>
+            <version>${log4j.version}</version>
         </dependency>
         <dependency>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-core</artifactId>
-            <version>2.8.2</version>
+            <version>${log4j.version}</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-core</artifactId>
-            <version>2.7.4</version>
+            <version>${jackson.version}</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>2.7.4</version>
+            <version>${jackson.version}</version>
         </dependency>
 		<dependency>
 			<groupId>org.neo4j</groupId>