Page History
[updated on 2021 12 17 1314:00 GMT+1]
More about the issue: https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
...
| Timestamp | Description |
|---|---|
| 2021 12 16 1417 14:00 GMT+1 | UpdatedRemediation options for modeling and collaboration tools. |
| 2021 12 17 13:00 GMT+1 | Updated log4j version from 2.15.0 to 2.16.0 for modeling and collaboration tools in Remediation. |
| 2021 12 16 14:00 GMT+1 | Added Cameo DataHub plugin to the list in Apache Log4j2 version 2.0-2.14.1 is a part of the following products, however it is not used for logging. No action to perform. |
| 2021 12 16 14:00 GMT+1 | Added information about FlexNet Publisher in Apache Log4j2 version 2.0-2.14.1 is a part of the following products. Action to perform. |
...
For collaboration tools (Magic Collaboration Studio, Cameo Collaborator for Teamwork Cloud, Teamwork Cloud)
Option 1
You may prevent lookups in the log event message by adding parameter via command line or in Web Application Platform setenv.sh / setenv.bat properties file.
Configuring setenv.bat file on Windows
If your instance of the Web Application Platform is running on Windows, configure this file by following one of the given workflows.
To configure setenv.bat files when the Web Application Platform is started by running an executable
...
Copy and paste the following line to the setenv.bat file:
| Code Block |
|---|
set JAVA_OPTS=-Dlog4j.formatMsgNoLookups=true |
...
To configure setenv.bat files when the Web Application Platform is started as a service
...
In the command-line interface, run the following command:
| Code Block |
|---|
.\bin\tomcat<version>.exe //US//WebApp --JvmMs=8000 --JvmMx=8000 ++JvmOptions='-Dlog4j.formatMsgNoLookups=true' |
...
Configuring setenv.sh file on Linux and Mac
If your instance of the Web Application Platform is running on Linux or Mac, configure this file by following the steps outlined below.
To configure setenv.sh file on Linux and Mac
...
Copy and paste the following lines to the setenv.sh file:
| Code Block |
|---|
set JAVA_OPTS=-Dlog4j.formatMsgNoLookups=true |
...
)
- Download the latest log4j 2.16.0 patched version.
- Replace all log4j 2.x jar files with their respective equivalents from the downloaded version 2.16.0 zip file while keeping the original file name.
...