Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0048258Openbravo ERPA. Platformpublic2021-12-15 16:132021-12-20 10:53
Reportershuehner 
Assigned Toshuehner 
PrioritynormalSeveritycriticalReproducibilityhave not tried
StatusclosedResolutionsuspended 
PlatformOS5OS Version
Product Version 
Target VersionFixed in Version 
Merge Request Status
Review Assigned To
OBNetwork customer
Web browser
ModulesCore
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0048258: How to manually backport log4j 2.17 to Openbravo version >= 19Q1
DescriptionThis issue contains description on how to manually backport the library update to log4j version 2.17 to older releases.

It can be used:
- If a project cannot update to 21Q3.7 or 21Q4.2 or 22Q1 yet
- but wants to apply the 2.17 library update recommend By Openbravo

Steps To ReproduceHaving Openbravo containing log4j library version:
- 2.x
- but not yet 2.17
Proposed SolutionHow to apply the update.
All steps from base Openbravo folder (aka source.path)
The required files are attached to this issue
Testing,stopping,starting application as usual for any code change

1.) Delete the following 5 files
lib/runtime/log4j-1.2-api-2.11.1.jar
lib/runtime/log4j-api-2.11.1.jar
lib/runtime/log4j-core-2.11.1.jar
lib/runtime/log4j-slf4j-impl-2.11.1.jar
lib/runtime/log4j-web-2.11.1.jar

2.) Extract new files from log4j-2.17.0-jar-files.zip
unzip log4j-2.17.0.jar-files.zip

3.a) For Openbravo version <21Q1
Apply patch log4j-pre21Q1.diff

3.b) For Openbravo version >=21Q1 y <21Q4
Apply patch log4j-21Q1-pre21Q4.diff

3.c) For Openbravo >= 21Q4
Apply patch log4j-21Q4.diff instead

4.) Recompile the application
# do NOT use ant smartbuild
ant compile.complete.deploy
Additional Information
TagsNo tags attached.
Relationships
related to defect 0048228 closed alostale update log4j to its latest version (2.15.0) 
related to defect 0048254 closed alostale update log4j to its latest version (2.16.0) 
related to defect 0047091 closed alostale log4j should be updated to the latest version 
related to defect 0048279 closed alostale update log4j to its latest version (2.17.0) 
Attached Fileszip log4j-2.17.0-jar-files.zip (2,116,080) 2021-12-20 10:51
https://issues.openbravo.com/file_download.php?file_id=16454&type=bug
diff log4j-21Q4.diff (3,510) 2021-12-20 10:53
https://issues.openbravo.com/file_download.php?file_id=16455&type=bug
diff log4j-21Q1-pre21Q4.diff (4,376) 2021-12-20 10:53
https://issues.openbravo.com/file_download.php?file_id=16456&type=bug
diff log4j-pre21Q1.diff (6,681) 2021-12-20 10:53
https://issues.openbravo.com/file_download.php?file_id=16457&type=bug
diff after-cherrypick-log4j-21Q1-pre21Q4.diff (2,318) 2021-12-20 10:53
https://issues.openbravo.com/file_download.php?file_id=16458&type=bug
Issue History
Date ModifiedUsernameFieldChange
2021-12-15 16:13shuehnerNew Issue
2021-12-15 16:13shuehnerAssigned To => Triage Platform Base
2021-12-15 16:13shuehnerModules => Core
2021-12-15 16:13shuehnerTriggers an Emergency Pack => No
2021-12-15 18:18shuehnerFile Added: log4j-2.16.0-jar-files.zip
2021-12-15 18:19shuehnerFile Added: log4j-21Q4.diff
2021-12-15 18:19shuehnerFile Added: log4j-pre21Q4.diff
2021-12-15 18:25shuehnerProposed Solution updated
2021-12-15 18:26shuehnerProposed Solution updated
2021-12-15 18:29shuehnerNote Added: 0133742
2021-12-15 18:30shuehnerAssigned ToTriage Platform Base => shuehner
2021-12-15 18:30shuehnerStatusnew => scheduled
2021-12-15 18:33shuehnerRelationship addedrelated to 0047901
2021-12-15 18:33shuehnerRelationship addedrelated to 0048228
2021-12-15 18:33shuehnerRelationship addedrelated to 0048254
2021-12-15 18:44shuehnerRelationship addedrelated to 0047091
2021-12-15 18:44shuehnerRelationship deletedrelated to 0047901
2021-12-15 18:44shuehnerNote Edited: 0133742bug_revision_view_page.php?bugnote_id=0133742#r23416
2021-12-15 18:47shuehnerProposed Solution updated
2021-12-15 19:03shuehnerNote Added: 0133745
2021-12-15 19:03shuehnerStatusscheduled => closed
2021-12-15 19:03shuehnerResolutionopen => suspended
2021-12-17 13:44AugustoMauchProposed Solution updated
2021-12-17 13:46AugustoMauchNote Edited: 0133742bug_revision_view_page.php?bugnote_id=0133742#r23419
2021-12-17 13:46AugustoMauchFile Deleted: log4j-pre21Q4.diff
2021-12-17 13:47AugustoMauchFile Added: log4j-21Q1-21Q4.diff
2021-12-17 13:47AugustoMauchProposed Solution updated
2021-12-17 13:47AugustoMauchFile Deleted: log4j-21Q1-21Q4.diff
2021-12-17 13:48AugustoMauchFile Added: log4j-21Q1-pre21Q4.diff
2021-12-17 13:53AugustoMauchFile Added: log4j-pre21Q1.diff
2021-12-17 13:55AugustoMauchFile Added: after-cherrypick-log4j-21Q1-pre21Q4.diff
2021-12-17 13:55AugustoMauchNote Edited: 0133742bug_revision_view_page.php?bugnote_id=0133742#r23420
2021-12-20 09:00alostaleRelationship addedrelated to 0048279
2021-12-20 10:44cbernerNote Edited: 0133742bug_revision_view_page.php?bugnote_id=0133742#r23423
2021-12-20 10:51cbernerSummaryHow to manually backport log4j 2.16 to Openbravo version >= 19Q1 => How to manually backport log4j 2.17 to Openbravo version >= 19Q1
2021-12-20 10:51cbernerDescription Updatedbug_revision_view_page.php?rev_id=23425#r23425
2021-12-20 10:51cbernerSteps to Reproduce Updatedbug_revision_view_page.php?rev_id=23427#r23427
2021-12-20 10:51cbernerProposed Solution updated
2021-12-20 10:51cbernerFile Added: log4j-2.17.0-jar-files.zip
2021-12-20 10:52cbernerFile Deleted: log4j-21Q4.diff
2021-12-20 10:52cbernerFile Deleted: log4j-2.16.0-jar-files.zip
2021-12-20 10:52cbernerFile Deleted: log4j-21Q1-pre21Q4.diff
2021-12-20 10:52cbernerFile Deleted: log4j-pre21Q1.diff
2021-12-20 10:53cbernerFile Deleted: after-cherrypick-log4j-21Q1-pre21Q4.diff
2021-12-20 10:53cbernerFile Added: log4j-21Q4.diff
2021-12-20 10:53cbernerFile Added: log4j-21Q1-pre21Q4.diff
2021-12-20 10:53cbernerFile Added: log4j-pre21Q1.diff
2021-12-20 10:53cbernerFile Added: after-cherrypick-log4j-21Q1-pre21Q4.diff

Notes
(0133742)
shuehner   
2021-12-15 18:29   
(edited on: 2021-12-20 10:44)
Above steps just simplify applying the following commits/issues as backports.
a.) <21Q1
- f9a3d51ca55107fca4092b7a6e34f6454889df62 (log4j 2.11.1 -> 2.14.1, issue 47091)
- 84357bd2eeaac2bf3be42f2151ef1834eebfa467 (log4j 2.14.1 -> 2.15.0, issue 48228)
- ac8698d34f048f78e4c04e7e3a2155ce8cf4030e (log4j 2.15.0 -> 2.16.0, issue 48254)
- 75a344ae2459ed375b81f9f94ac4dbad4c431412 (log4j 2.16.0 -> 2.17.0, issue 48279)
Apply patch after-cherrypick-log4j-21Q1-pre21Q4.diff
b.) >=21Q1 and < 21Q4
- f9a3d51ca55107fca4092b7a6e34f6454889df62 (log4j 2.11.1 -> 2.14.1, issue 47091)
- 84357bd2eeaac2bf3be42f2151ef1834eebfa467 (log4j 2.14.1 -> 2.15.0, issue 48228)
- ac8698d34f048f78e4c04e7e3a2155ce8cf4030e (log4j 2.15.0 -> 2.16.0, issue 48254)
- 75a344ae2459ed375b81f9f94ac4dbad4c431412 (log4j 2.16.0 -> 2.17.0, issue 48279)

c.) >= 21Q4
- 84357bd2eeaac2bf3be42f2151ef1834eebfa467 (log4j 2.14.1 -> 2.15.0, issue 48228)
- ac8698d34f048f78e4c04e7e3a2155ce8cf4030e (log4j 2.15.0 -> 2.16.0, issue 48254)
- 75a344ae2459ed375b81f9f94ac4dbad4c431412 (log4j 2.16.0 -> 2.17.0, issue 48279)
(0133745)
shuehner   
2021-12-15 19:03   
This issue is just about documenting how to easily backport the log4j change to older releases.
Marked as closed as no action required on product side (there the changes are already done (see linked issues))