Affected Versions

EasyAccess <= 4.1.2

Fix Information

To mitigate this threat, add the following parameter to the startup file:
-Dlog4j2.formatMsgNoLookups=true

On Linux, set the parameter in /bin/start-PhenixID.sh (JAVA_OPTS=”${JAVA_OPTS} -Dlog4j2.formatMsgNoLookups=true”)
On Windows, set the parameter in /bin/*.vmoptions (-Dlog4j2.formatMsgNoLookups=true)

For more detail, please don’t hesitate to contact Clavister Support!

Security Patches

An updated version of log4j2 will be included in all future releases.

Updated versions will be available from https://my.clavister.com/

References

• https://www.clavister.com/advisories/security/clav-sa-0297-high-severity-vulnerability-in-apache-log4j2
• https://nvd.nist.gov/vuln/detail/CVE-2021-44228

Related articles