Skip to content

fix(security): remediate Log4Shell + EOL Jackson in neo4j transaction-event-handler #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pallakartheekreddy wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(security): remediate Log4Shell + EOL Jackson in neo4j transaction-event-handler #21

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 11 additions & 5 deletions neo4j-extensions/transaction-event-handler/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,33 +9,39 @@

<properties>
<neo4j.version>3.0.4</neo4j.version>
<!-- log4j 2.17.1 is the last line guaranteeing Java 8 and fully remediates the
Log4Shell CVE chain (CVE-2021-44228/45046/45105/44832). Keep the three
artifacts in lockstep via this property. -->
<log4j.version>2.17.1</log4j.version>
<!-- Jackson 2.17.x replaces the EOL 2.7.4 (polymorphic-deserialization CVEs); Java-8 compatible. -->
<jackson.version>2.17.2</jackson.version>
Comment on lines +12 to +17

@coderabbitai coderabbitai Bot Jul 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

module='neo4j-extensions/transaction-event-handler'
effective_pom="$(mktemp)"
trap 'rm -f "$effective_pom"' EXIT

mvn -pl "$module" -am help:effective-pom -Doutput="$effective_pom"
mvn -pl "$module" -am dependency:tree -Dverbose \
  '-Dincludes=org.apache.logging.log4j:*,com.fasterxml.jackson.core:*'

if rg -n '2\.8\.2|2\.7\.4' "$effective_pom"; then
  echo "Vulnerable dependency versions remain in the effective POM" >&2
  exit 1
fi

rg -n '<log4j.version>|<jackson.version>|\$\{(log4j|jackson)\.version\}' \
  "$effective_pom"

Repository: Sunbird-Knowlg/knowledge-platform-db-extensions

Length of output: 226

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

# Locate the target POM and related dependency declarations.
git ls-files 'neo4j-extensions/transaction-event-handler/pom.xml' \
  'neo4j-extensions/**/pom.xml' \
  'pom.xml' \
  | sed -n '1,200p'

echo
echo '--- target pom excerpt ---'
cat -n neo4j-extensions/transaction-event-handler/pom.xml | sed -n '1,220p'

echo
echo '--- search for log4j/jackson version properties and overrides ---'
rg -n '<(log4j|jackson)\.version>|log4j-core|log4j-1\.2-api|jackson-databind|jackson-annotations|jackson-core' \
  neo4j-extensions pom.xml -g 'pom.xml'

Repository: Sunbird-Knowlg/knowledge-platform-db-extensions

Length of output: 6026

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

# Check whether the module uses only these two properties or if there are other overrides in the reactor.
rg -n '2\.17\.1|2\.17\.2|2\.8\.2|2\.7\.4|2\.18|2\.21|log4j.version|jackson.version' \
  . -g 'pom.xml' -g 'pom.properties' -g 'build.gradle' -g 'build.gradle.kts' -g 'gradle.properties'

Repository: Sunbird-Knowlg/knowledge-platform-db-extensions

Length of output: 1379

🌐 Web query:

Apache Log4j 2.17.1 maintenance status Java 8 current release line official site Jackson 2.17 2.18 Java 8 official release notes

💡 Result:

Apache Log4j 2.17.1 is in End-of-Maintenance (EOM) status [1]. The Apache Log4j project does not provide active maintenance, including security updates, for the 2.17.x line; only the latest release in the 2.x series receives such updates [2][3]. Users are advised to upgrade to the latest 2.x release, which remains compatible with Java 8 [1][4][5]. Regarding Jackson, both version 2.17 and 2.18 are established releases [6][7][8]. Jackson 2.18 was released on September 26, 2024, and is designated as a Long-Term-Support (LTS) version intended to be open for patch releases through at least the end of 2026 [7]. Both 2.17 and 2.18 require a minimum of Java 8 [9]. Jackson release notes confirm that these versions continue to support Java 8 environments and have introduced features related to Java 8 datatypes and records [7][8].

Citations:

Bump Log4j off the EOM line neo4j-extensions/transaction-event-handler/pom.xml:12-17 pins log4j-api, log4j-core, and log4j-1.2-api to 2.17.1; move them to the latest Java 8-compatible 2.x release. jackson.version can stay at 2.17.2.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@neo4j-extensions/transaction-event-handler/pom.xml` around lines 12 - 17,
Update the log4j.version property in the transaction-event-handler Maven
configuration from 2.17.1 to the latest Java 8-compatible 2.x release, keeping
log4j-api, log4j-core, and log4j-1.2-api aligned through that property. Leave
jackson.version at 2.17.2 and revise the outdated Log4j comment accordingly.

Source: MCP tools

</properties>

<dependencies>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-1.2-api</artifactId>
<version>2.8.2</version>
<version>${log4j.version}</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
<version>2.8.2</version>
<version>${log4j.version}</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>2.8.2</version>
<version>${log4j.version}</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-core</artifactId>
<version>2.7.4</version>
<version>${jackson.version}</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>2.7.4</version>
<version>${jackson.version}</version>
</dependency>
<dependency>
<groupId>org.neo4j</groupId>
Expand Down