Start a conversation Sign in
Start a conversation
  1. Quark Publishing Platform
  2. QPP - Technical Support
  3. Public Articles

Steps for the deployment of the hotfix for Log4j 2.x vulnerabilities in Quark Publishing Platform

Background: Log4Shell vulnerable jars were found, which may trigger false positives in vulnerability scanners, below hotfix will fix the same.

Applies: Quark Publishing Platform 15.x (QPP)
Solution: Below are the instructions to apply the hotfix in the Quark Publishing Platform: 
 
  1. Stop Quark Publishing Platform Server and ensure that no instances of Quark Publishing Platform Server are running in the Task Manager.
  2. Replace the old Log4j.jar files with the new Log4J-XXX-2.17.0.jar files:
    1. Navigate to the folder “[$Quark Publishing Platform Installation]\dependencies” (C:\Program Files\Quark\Quark Publishing Platform\dependencies).
    2. Take a backup of all the *.jar files whose name starts with “Log4J-XXX-2.*” from the folder C:\Program Files\Quark\Quark Publishing Platform\dependencies. For example, log4j-api-XXX.jar, log4j-core-XXX.jar
    3. Delete all the .jar files whose name starts with “Log4J-XXX-2.*” in the folder C:\Program Files\Quark\Quark Publishing Platform\dependencies. For example, log4j-api-2.8.2.jar, log4j-core-2.8.2.jar
    4. Copy the jar files extracted from Log4j_2.17_HotFix\QPP\Log4j_2.17_HotFix(QPP).zip” in the provided hotfix to the folder “C:\Program Files\Quark\Quark Publishing Platform\dependencies” as described in step a.
      (for Quark Publishing Platform 15):
                      - log4j-api-2.17.0.jar
                      - log4j-core-2.17.0.jar
  1. Modify the file “wrapper.conf” to adhere to the new version of log4j jar files.
    1. Take a backup of the file wrapper.conf from “[$Quark Publishing Platform Installation]\” (C:\Program Files\Quark\Quark Publishing Platform\ wrapper.conf)
    2. Edit the file wrapper.conf in “[$Quark Publishing Platform Installation]\” and then search and replace the following two instances of the log4j references (for QPP 15):
- Replace text - log4j-api-XXX.jar with log4j-api-2.17.0.jar
- Replace text - log4j-core-XXX.jar with log4j-core-2.17.0.jar
  1. Start Quark Publishing Platform Server and verify that the server is creating logs in the log files in “[$Quark Publishing Platform Installation]\log\.”

Choose files or drag and drop files
sf_kb_import
Was this article helpful?
Yes
No

  1. Priyanka Bhotika

  2. Posted
  3. Updated

Comments