Updating log4j version in DFC jars

sudh_ysk · 2022-11-14T22:14:01+00:00

There was an error rendering this rich post.

Hi. I am using Documentum 16.7 and using DFC to connect to Documentum. I am fairly new to Documentum. Recently our application was flagged for a log4j vulnerability. I have been doing some research and found that DFC internally uses log4j 1.x versions. How do we update the dfc.jar and other DFC jars to latest log4j 2.x versions? Appreciate any help.

Find more posts tagged with

Comments

fawazgi

KB0563836 covers your issue. I'll try to include the link.

Support articles, alerts & useful tools - Documentum Foundation Classes - Log4j vulnerability (opentext.com)

Hicham Bahi

Log4j 1.x doesn't have the vulnerability, so you don't need to do anything. In fact, DFC 16.7 will not work with log4j2. If you still want to use log4j2 for whatever reason, then use a later DFC version, e.g. 22.4 but make sure it's certified for the Content Server version you are running.