Re: [Exist-open] log4j2 vulnerability

[Mathias G. <go...@su...>]

Hey Juri,

can you explain why adding the system property is not sufficient in the 
case of existdb? I added the recommended parameter 
"-Dlog4j2.formatMsgNoLookups" to the $JAVA_OPTS.

Also I guess that setting this parameter as Property in log4j2.xml 
configuration file might also be one alternative.

best,
Mathias

On 11.12.21 21:32, Juri Leino wrote:
> "%m" with "%m{noLookups}"
-- 
Mathias Göbel
University of Göttingen
c .ivü-ö- Library
D-37070 Göttingen

Research and Development
Papendiek 14 (hist. Building, Room 2.408 
<https://lageplan.uni-goettingen.de/?ident=7209_4_2.OG_2.408>)
+49 551 39-25823 (Tel., Wednesday to Friday)
+49 551 39-33856 (Fax.)

Digital Library
Software and Service Development
Platz der Göttinger Sieben 1 (Central Library, Room 2.129 
<https://lageplan.uni-goettingen.de/?ident=5383_1_2.OG_2.129>)
+49 551 39-10230 (Tel., Monday/Tuesday)

go...@su... <mailto:go...@su...= -goettingen.de>
http://www.sub.uni-goettingen.de 
<https://www.sub.uni-goettingen.de/en/news/>