GEODE-10544: Upgrade Apache Log4j from version 2.17.2 to 2.25.3 to remediate security vulnerability CVE-2025-68161.

[JinwooHwang]

Summary

This PR upgrades Apache Log4j from version 2.17.2 to 2.25.3 in the Geode 1.15 codebase to remediate security vulnerability CVE-2025-68161. This upgrade also brings performance improvements from the latest Log4j release. All tests pass successfully.

Security Impact

CVE-2025-68161: This upgrade addresses a critical security vulnerability in Log4j 2.17.2. Upgrading to 2.25.3 remediates this vulnerability and ensures the security of applications using Geode 1.15.

Changes Made

1. Version Update

• File: build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy
• Updated log4j.version from "2.17.2" to "2.25.3"
• Added log4j-core-test to the dependency set (line 215-221)

2. GraalVM Configuration

• File: geode-log4j/build.gradle
• Added GraalVM annotation processor configuration (lines 25-30):

  tasks.withType(JavaCompile) {
    options.compilerArgs.addAll([
      '-Alog4j.graalvm.groupId=org.apache.geode',
      '-Alog4j.graalvm.artifactId=geode-log4j'
    ])
  }

• Required by Log4j 2.25.3 for native image support

3. Test Dependency Migration

• File: geode-log4j/build.gradle

• Migrated from log4j-core::tests and log4j-core::test-sources (removed in 2.25.3)

• Log4j 2.20.0+ moved test utilities to log4j-core-test with new package names:
  org.apache.logging.log4j.junit → org.apache.logging.log4j.core.test.junit
  org.apache.logging.log4j.test → org.apache.logging.log4j.core.test

• Added log4j-core-test artifact with exclusions to resolve dependency conflicts:

  integrationTestImplementation('org.apache.logging.log4j:log4j-core-test') {
    exclude group: 'org.apache.maven'
    exclude group: 'org.apache.logging.log4j', module: 'log4j-api-test'
    exclude group: 'org.assertj', module: 'assertj-core'
    exclude group: 'org.junit.jupiter'
    exclude group: 'org.junit.platform'
  }

• Exclusions required because:

  • log4j-core-test 2.25.3 requires the following exclusions:
    • assertj-core 3.27.3: conflicts with Geode's 3.22.0 custom assertions
      (NoSuchMethodError: CommonValidations.failIfEmptySinceActualIsNotEmpty)
    • maven-core 3.9.10: causes Gradle dependency resolution conflict with Guava
    • log4j-api-test: brings JUnit 5.13.2 transitively
    • junit.jupiter/platform 5.13.2: conflicts with project's JUnit 5.8.2
      (JUnitException: OutputDirectoryProvider not available due to version mismatch)

4. Package Structure Updates (20 Integration Test Files)

Log4j 2.25.3 reorganized test utility packages. Updated imports in all integration test files:

Old Package Names:

• org.apache.logging.log4j.junit.LoggerContextRule
• org.apache.logging.log4j.test.appender.ListAppender

New Package Names:

• org.apache.logging.log4j.core.test.junit.LoggerContextRule
• org.apache.logging.log4j.core.test.appender.ListAppender

Files Updated:

1. AlertAppenderIntegrationTest.java
2. BothLogWriterAppendersIntegrationTest.java
3. CacheWithCustomLogConfigIntegrationTest.java
4. ConfigurationWithLogLevelChangesIntegrationTest.java
5. ConsoleAppenderWithLoggerContextRuleIntegrationTest.java
6. DistributedSystemWithBothLogWriterAppendersIntegrationTest.java
7. DistributedSystemWithLogLevelChangesIntegrationTest.java
8. FastLoggerIntegrationTest.java
9. GemfireVerboseMarkerFilterAcceptIntegrationTest.java
10. GemfireVerboseMarkerFilterDenyIntegrationTest.java
11. GeodeConsoleAppenderIntegrationTest.java
12. GeodeConsoleAppenderWithCacheIntegrationTest.java
13. GeodeConsoleAppenderWithSystemOutRuleIntegrationTest.java
14. GeodeVerboseMarkerFilterAcceptIntegrationTest.java
15. GeodeVerboseMarkerFilterDenyIntegrationTest.java
16. LogServiceWithCustomLogConfigIntegrationTest.java
17. LogWriterAppenderIntegrationTest.java
18. LogWriterAppenderWithLimitsIntegrationTest.java
19. LogWriterAppenderWithMemberNameInXmlIntegrationTest.java
20. SecurityLogWriterAppenderIntegrationTest.java

5. Deprecation Warning Fix

• File: geode-logging/src/main/java/org/apache/geode/logging/internal/log4j/api/message/GemFireParameterizedMessage.java
• Added @SuppressWarnings("deprecation") annotation to getFormat() method
• Log4j 2.25.3 deprecated Message.getFormat() but Geode must maintain interface compatibility

Breaking Changes in Log4j 2.25.3

Test Artifact Restructuring

• Removed: log4j-core::tests and log4j-core::test-sources classifier artifacts
• Added: Separate log4j-core-test Maven artifact
• Impact: Required updating test dependencies and adding dependency exclusions

Package Reorganization

• Test utility classes moved to org.apache.logging.log4j.core.test.* packages
• Impact: Required updating imports in 20 integration test files

API Deprecations

• Message.getFormat() method deprecated
• Impact: Added suppression annotation for backward compatibility

Testing Performed

All Tests Passed

• Unit Tests: ./gradlew :geode-log4j:test - All tests pass
• Integration Tests: ./gradlew :geode-log4j:integrationTest - All 177 tests pass
• Compilation: ./gradlew clean build -x test - Successful (BUILD SUCCESSFUL in 1m 20s)
• Code Quality Checks:
  • spotlessCheck - Code formatting verified
  • rat - License headers validated
  • checkPom - POM files validated
  • pmdMain - Static analysis passed
  • japicmp - API/ABI compatibility verified
  • resolveDependencies - Dependency resolution successful
• Installation: ./gradlew install - Successful
• Documentation: ./gradlew javadoc - Generated successfully

Key Test Fixes

Resolved initial integration test failures by excluding conflicting transitive dependencies from log4j-core-test:

• Excluded JUnit Platform 5.13.2 (project uses 5.8.2)
• Excluded assertj-core 3.27.3 (project uses 3.22.0 with custom assertions)

Full Build Test Results

• Total Tasks: 656 actionable tasks (307 executed, 231 from cache, 118 up-to-date)
• Build Time: 28m 26s
• Modules Tested: All 30+ Geode modules compile and pass quality checks

Dependency Analysis

Before (Log4j 2.17.2)

dependencies {
  implementation("org.apache.logging.log4j:log4j-api:2.17.2")
  implementation("org.apache.logging.log4j:log4j-core:2.17.2")
  integrationTestImplementation("org.apache.logging.log4j:log4j-core:2.17.2:tests")
}

After (Log4j 2.25.3)

dependencies {
  implementation("org.apache.logging.log4j:log4j-api:2.25.3")
  implementation("org.apache.logging.log4j:log4j-core:2.25.3")
  integrationTestImplementation("org.apache.logging.log4j:log4j-core-test:2.25.3") {
    exclude group: 'org.apache.maven'
    exclude group: 'org.apache.logging.log4j', module: 'log4j-api-test'
    exclude group: 'org.assertj', module: 'assertj-core'
    exclude group: 'org.junit.jupiter'
    exclude group: 'org.junit.platform'
  }
}

Migration Reference

This upgrade was guided by the patterns from:

• Log4j 2.25.3 Release Notes
• Maven Central artifacts for log4j-core-test

Checklist

• Updated Log4j version in dependency constraints
• Fixed compilation errors
• Updated test dependencies
• Updated package imports in test files
• Suppressed deprecation warnings appropriately
• Verified code formatting (spotlessCheck)
• Verified license headers (rat)
• Verified POM files (checkPom)
• Verified API compatibility (japicmp)
• Ran static analysis (pmdMain)
• Verified unit tests pass
• Verified integration tests pass

Recommendations for Reviewers

1. Focus Areas:

   • Verify import changes in integration test files are consistent
   • Review GraalVM configuration for correctness
   • Confirm dependency exclusions are appropriate

2. Testing Strategy:

   • Run full build: ./gradlew clean build -x test
   • Run test: ./gradlew test
   • Run geode-log4j tests: ./gradlew :geode-log4j:test :geode-log4j:integrationTest
   • Verify quality checks: ./gradlew spotlessCheck rat checkPom japicmp

3. Future Work:

   • Consider upgrading to Log4j 2.26.x when available
   • Monitor for any runtime issues in production environments

Related Issues

• JIRA: GEODE-10544
• CVE: CVE-2025-68161 (remediated by Log4j 2.25.3)
• Target Branch: support/1.15
• Base Branch: support/1.15

Additional Notes

This is a targeted security upgrade for the 1.15 support branch to remediate CVE-2025-68161. The main development branch may already have a newer version of Log4j. This upgrade focuses on security and stability improvements for the 1.15 release line while maintaining full backward compatibility.

Important: This upgrade should be prioritized for deployment to production environments to address the security vulnerability.

For all changes, please confirm:

• Is there a JIRA ticket associated with this PR? Is it referenced in the commit message?
• Has your PR been rebased against the latest commit within the target branch (typically develop)?
• Is your initial contribution a single, squashed commit?
• Does gradlew build run cleanly?
• Have you written or updated unit tests to verify your changes?
• If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under ASF 2.0?