Submit Feedback
Legacy Knowledge Base
Published Jun. 30, 2025

Outdated or vulnerable components can sometimes be found in the .cp/ folder inside osgi/state/folder

Written By

Neil Cuzon

How To articles are not official guidelines or officially supported documentation. They are community-contributed content and may not always reflect the latest updates to Liferay DXP. We welcome your feedback to improve How To articles!

While we make every effort to ensure this Knowledge Base is accurate, it may not always reflect the most recent updates or official guidelines.We appreciate your understanding and encourage you to reach out with any feedback or concerns.

Legacy Article

You are viewing an article from our legacy "FastTrack" publication program, made available for informational purposes. Articles in this program were published without a requirement for independent editing or verification and are provided"as is" without guarantee.

Before using any information from this article, independently verify its suitability for your situation and project.

Issue

  • We've run a security scan and it is picking up outdated components inside the .cp/lib/ subfolder of the osgi/state/ folder, and it is confusing our compliance efforts. 

Environment

  • Liferay DXP 7.0, 7.1, 7.2, 7.3, 7.4

Resolution

  • This behavior is likely caused by an outdated plugin or module and to determine which one is out of date, you can run lbin GoGo Shell and look for the bundle that is associated with the folder containing the /.cp/lib subfolder. This should show the bundles depending on the outdated version that was detected. 
  • For example, an outdated log4j-1.2.17.jar is detected in the below physical address: 
    osgi/state/org.eclipse.osgi/1090/0/.cp/lib/log4j-1.2.17.jar
    The component that was causing the issue, was found to be associated with the 1090 folder, which as shown in the address above, contained the .cp/lib/ and the vulnerable component folder.

    The folder numbers are likely to differ, however using the lb command  would allow you to find the folder containing the .cp/libfolder and the bundle responsible for calling it. 

    Make a note of the bundle that is associated with that folder number. You can then open a Support Ticket and notify support of the name of the suspected component.  

    If you are unable to find the matching component in question, you can attempt the following steps:
    1. Stop your server
    2. Delete the osgi/state folder
    3. Restart Liferay
    4. Run lb in GoGoShell

Additional Information:

Using the gogo shell

How to verify that a Log4j patch has resolved all log4j vulnerabilities.

 

Did this article resolve your issue ?
Legacy Knowledge Base
Did this article resolve your issue ?