In December 2021, the serious Log4j security vulnerability became known, affecting numerous systems worldwide. Liferay responded quickly and initiated a comprehensive analysis of its own products to identify potential risks. It found that older versions of the Log4j library were used in some components of the Liferay portal. The team promptly developed patches to update the affected libraries to secure versions. At the same time, Liferay provided detailed instructions on how customers could fix the vulnerability manually if they were unable to apply the patches immediately.
In addition, short-term configuration changes were recommended to minimize the attack surface until the full updates had been installed. Liferay stressed the importance of regular updates and urged all customers to keep their installations up to date. The published patches were extensively tested to ensure that they do not cause any further problems. Through these measures, Liferay was able to provide its customers with fast and reliable protection against the vulnerability.
You can find more information on the Log4j vulnerability and the corresponding measures here: https://liferay.dev/blogs/-/blogs/log4j2-zero-day-vulnerability
