SAP Commerce Build affected by Log4j Jar replacement

[PrashanthPundalik]

I am getting below error when i run a Ant command in Hybris Commerce 1811 environment.

The following error occurred while executing this line:

/hybris/hyb1811_DH/hybris/bin/platform/resources/ant/antmacros.xml:85: taskdef A class needed by class de.hybris.ant.taskdefs.DbDriverValidator cannot be found: org/apache/log4j/Logger

As per SAP note 3130982 - Mitigating Commerce Platform's Apache Log4j security vulnerabilities (CVE-2021-44228 and CVE-2021-45046) on SAP Commerce Cloud in SAP Infrastructure

SAP suggested to perform few steps to avoid LOG4J vulnerabilities from then this issue is coming up. Any one else facing this issue and what could be the solution for this.

Edit : log4j-core-2.9.jar is replaced with log4j-core-2.17.jar as per SAP note

Thanks In Advance

[PrashanthPundalik]

/hybris/hyb1811_DH/hybris/bin/platform/build.xml:16: The following error occurred while executing this line:

/hybris/hyb1811_DH/hybris/bin/platform/resources/ant/antmacros.xml:85: taskdef A class needed by class de.hybris.ant.taskdefs.DbDriverValidator cannot be found: org/apache/log4j/Logger

using the classloader AntClassLoader[/hybris/hyb1811_DH/hybris/bin/platform/bootstrap/bin/ybootstrap.jar:/hybris/hyb1811_DH/hybris/bin/platform/bootstrap/bin/yant.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/accessors-smart-1.2.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/annotations-2.0.0.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/ant-commons-net-1.6.5.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/aopalliance-1.0.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/asm-3.3.1.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/aspectjweaver-1.9.0.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/assertj-core-3.5.2.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/bcprov-jdk15on-1.60.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/bsh-2.0b6.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/btc-ascii-table-1.0.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/cglib-nodep-2.2.2.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/charon-1.2.4-RC1.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/cloning-1.9.0.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/com.sap.security.core.server.csi-1.00.8.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/commons-beanutils-1.9.2.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/commons-codec-1.10.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/commons-collections-3.2.2.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/commons-collections4-4.1.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/commons-configuration-1.10.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/commons-dbcp-1.4.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/commons-digester-2.1.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/commons-discovery-0.5.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/commons-el-1.0.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/commons-email-1.5.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/commons-fileupload-1.3.3.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/commons-io-2.4.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/commons-jexl-1.1.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/commons-lang-2.6.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/commons-lang3-3.7.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/commons-logging-1.2.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/commons-pool-1.6.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/commons-pool2-2.4.2.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/commons-validator-1.4.1.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/concurrentlinkedhashmap-lru-1.4.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/ddlutils-1.0.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/easymock-3.1.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/easymockclassextension-3.1.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/ehcache-2.9.0.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/fastutil-6.5.6.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/fest-assert-1.4.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/fest-util-1.1.6.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/groovy-all-2.4.11.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/guava-23.0.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/hamcrest-all-1.3.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/hk2-2.4.0-b31.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/hk2-api-2.4.0-b31.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/hk2-locator-2.4.0-b31.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/hk2-utils-2.4.0-b31.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/httpclient-4.5.6.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/httpcore-4.4.8.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/httpmime-4.5.4.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/httpunit-1.7.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/hybris-encryption-1.1.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/hybris-simple-statistics-1.0.1.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/hybriskey-1.0.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/jackson-annotations-2.9.8.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/jackson-core-2.9.8.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/jackson-databind-2.9.8.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/javax.inject-2.4.0-b31.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/javax.ws.rs-api-2.0.1.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/javolution-5.5.1.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/jaxen-1.1.3.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/jcip-annotations-1.0.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/jcl-over-slf4j-1.7.21.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/jersey-apache-connector-2.25.1.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/jersey-client-2.25.1.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/jersey-common-2.25.1.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/jersey-entity-filtering-2.25.1.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/jersey-guava-2.25.1.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/jersey-media-json-jackson-2.25.1.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/jersey-server-2.25.1.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/jersey-spring3-2.25.1.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/jersey-test-framework-core-2.25.1.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/jgroups-4.0.15.Final.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/joda-time-2.9.9.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/json-path-2.4.0.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/json-smart-2.3.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/jsr305-2.0.0.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/jstl-api-1.2.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/junit-4.12.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/kxml2-2.3.0.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/likey-no-iaik-1.0.3.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/log4j-api-2.17.0.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/log4j-core-2.17.0.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/log4j-slf4j-impl-2.17.0.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/mail-1.4.4.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/metrics-core-4.0.2.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/metrics-healthchecks-4.0.2.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/mime-util-2.1.3.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/mockito-core-1.10.19.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/netty-buffer-4.1.5.Final.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/netty-codec-4.1.5.Final.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/netty-codec-http-4.1.5.Final.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/netty-codec-socks-4.1.5.Final.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/netty-common-4.1.5.Final.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/netty-handler-4.1.5.Final.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/netty-handler-proxy-4.1.5.Final.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/netty-resolver-4.1.5.Final.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/netty-transport-4.1.5.Final.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/objenesis-1.4.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/orika-core-1.5.2.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/oro-2.0.8.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/paranamer-2.8.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/pmd-core-5.5.5.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/pmd-groovy-5.5.5.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/pmd-java-5.5.5.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/pmd-javascript-5.5.5.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/pmd-jsp-5.5.5.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/pmd-vm-5.5.5.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/pmd-xml-5.5.5.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/powermock-api-mockito-1.7.0.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/powermock-api-mockito-common-1.7.0.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/powermock-api-support-1.7.0.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/powermock-core-1.7.0.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/powermock-module-junit4-1.7.0.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/powermock-module-junit4-common-1.7.0.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/powermock-reflect-1.7.0.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/reactor-core-1.1.6.RELEASE.jar:/hybris/hyb1811_DH/hybris/bin/platform/ext/core/lib/reflections-

[StefanKruk]

I would suggest to Patch the Jar that is delivered with SAP Commerce like it is explained here: https://launchpad.support.sap.com/#/notes/3130939

Also did you consider trying to upgrade the Patch Version, as well as planning Upgrading the Major Version?

[PrashanthPundalik]

Thanks Stefan for the response.

Already done this patching. As our hybris platform is running on 1811 version I am not sure if the log4j-core-2.17 is supported.

The build does not start when I trigger ant. else would have checked the logs for error.