Upgrade log4j-core to version 2.26.1 due to 3rd-party vulnerability CVE-2025-68161

Current Situation

• JS7 Controller and Agent ship with Log4j version 2.24.3 which is affected by the CVE-2025-68161 vulnerability, for details see https://nvd.nist.gov/vuln/detail/CVE-2025-68161.
• We rate the impact on JS7 products as Low, because JS7 does not make use of the SocketAppender (with TLS over TCP) in question. To exploit the vulnerability, users must individually add this log appender using TLS connections that would not verify hostnames during key exchange when establishing connections.

Desired Behavior

• JS7 Controller and Agent should use Log4j version 2.26.1 which addresses the issue.

Maintainer Notes

• It was not an option for JS7 products using Log4j 2.25.3 that includes an unacceptable bug. Therefore, the issue was dismissed and is resumed with availability of a working version of Log4j.
• For mitigation of the CVE, users should verify from their log4j2.xml configuration files in use for JOC Cockpit, Controller and Agents, if they individually added a SocketAppender using a TLS connection to an untrusted host.  By default no such log appender is used. For details see JS7 - Log Files and Locations.