Fix log4j2 vulnerability | log4j2 issue | log4j2 Fix | CVE-2021-45046 | All about log4j2 |okay java

#log4j2 #log4j2fix #log4j2vulnerabilityfix #okayjava
log4j2 vulnerability fix | log4j2 issue | log4j2 Fix | CVE-2021-45046 | All about log4j2 |okay java


download the source code

status = debug
name = log4j2Config

#Log file location and name

#Rolling File appender

#Time based log file rotation policy

# Must configure root logger

What is Log4j2 VUNERABILITY or 0 day vulnerability?
what is JNDI – Look up ?
The Java Naming and Directory Interface (JNDI) is a Java API for a directory service that allows Java software clients to discover and look up data and resources (in the form of Java objects) via a name.. database/Ldap server etc
Attackers can use the JNDI look up to install any exe file or run a shell script on your production server.
${jndi:ldap://{malicious website}/a}
${jndi:ldap:/}${jndi:ldaps:/}
${jndi:rmi:/}
${jndi:dns:/}
${jndi:iiop:/}

Affected versions??
Log4j1.x - safe and secure :)
Apache Log4j 2.x to 2.15.0 :(

How to FIX/Mitigation ?
Log4j1.x - safe and secure :)
No action required…. Cheers !!
Apache Log4j 2.x to 2.15.0 ??
Java 8 (or later) users should upgrade to release 2.16.0.
Java 7 should upgrade to release 2.12.2 when it becomes available (WIP)
For gt;=2.10, set environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true.

Read more about the security vulnerability
JIRA ticket

subscribe okayjava..thank you

[vellinari]

Hi Sir. My project is log4j-1.2.4
So does it come under 1.x or 2.x? Please reply.

[pallavimali]

Can u let know is their any config file where I need to add version details, also let know how to check which log4j version I am using on webspere application server