Java 21 Upgrade & Compatibility Analysis
This guide breaks down the compatibility, security risks, JVM runtime flags, and migration strategies for Log4j 1.2.17 and Jackson Annotations 2.17.2 when running on Java 21.
1. Artifact: log4j:log4j:1.2.17
Overview & JDK Target
-
Original JDK Target: Java 1.4 (Class file major/minor version
48.0). Built to run on JDK 1.4 through JDK 8. - Java 21 Behavior: When executing directly under Java 21 without upgrading, strong Java Platform Module System (JPMS) encapsulation blocks reflection into internal JDK APIs unless explicit command-line flags are configured.
Critical Vulnerabilities & Security Risks
Log4j 1.2.17 has been End-of-Life (EOL) since August 2015 and contains severe unpatched security vulnerabilities:
-
CVE-2019-17571 (CVSS 9.8): Remote Code Execution (RCE) via untrusted deserialization in
SocketServer. -
CVE-2021-4104: Deserialization vulnerability when configured to use
JMSAppender. -
CVE-2022-23302: Deserialization vulnerability when configured to use
JMSSink. -
CVE-2022-23305 (CVSS 9.8): SQL Injection in
JDBCAppender.
Temporary Workaround: JVM Command-Line Flags
If you cannot immediately upgrade dependencies and must run unpatched log4j:log4j:1.2.17 on Java 21, pass these JVM flags to bypass encapsulation restrictions:
bash
--add-opens=java.base/java.lang=ALL-UNNAMED
--add-opens=java.base/java.util=ALL-UNNAMED
-Dsun.util.logging.disableWindowWarning=true
Top comments (0)