3 ms·
The solution of using {nolookups} on every logging pattern is only available from version 2.7 and above. https://stackoverflow.com/a/42802636/270317 https://st
by skimania 5y ago
The solution of using {nolookups} on every logging pattern is only available from version 2.7 and above.
https://stackoverflow.com/a/42802636/270317 https://stackoverflow.com/a/42802636/270317
- LOG4J2-2109 5y agoConfirming that this is correct: the {nolookups} option was added in v2.7 as a result of LOG4J2-905, so this mitigation is not available on versions prior to 2.7. Corroborating sources: [4] https://issues.apache.org/jira/browse/LOG4J2-905 https://issues.apache.org/jira/browse/LOG4J2-905 [5] https://logging.apache.org/log4j/2.x/changes-report.html#a2.7 https://logging.apache.org/log4j/2.x/changes-report.html#a2.... Checking on the viability of the classloading-based mitigations now across the versions. It seems that LOG4J-1051 was raised [6] to make the class instantiator more tolerant of missing classes, and the resulting changes were released in v2.4 and v2.7. Will check how earlier versions behave in this case. [6] https://issues.apache.org/jira/browse/LOG4J2-1051 https://issues.apache.org/jira/browse/LOG4J2-1051
- deleted 5y ago[deleted]