15 Dec
2021
15 Dec
'21
7:21 p.m.
On 15.12.21 08:45, Alessio Cecchi wrote:
SOLR_OPTS="$SOLR_OPTS -Dlog4j2.formatMsgNoLookups=true" and should be enough to prevent this vulnerability.
Possibly not anymore, see CVE-2021-45046 ("re-opened" CVE-2021-44228 for v2 prior to 2.16.0) and CVE-2021-4104 (variant for v1, in the meantime - at least by Red Hat - downgraded to *not* be a *Remote* Code Execution (RCE) vuln) ...
Regards,
Jochen Bern Systemingenieur
Binect GmbH