https://bugzilla.redhat.com/show_bug.cgi?id=2030932
Sam Fowler sfowler@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |sfowler@redhat.com
--- Comment #58 from Sam Fowler sfowler@redhat.com --- (In reply to Al from comment #56)
Is setting the LOG4J_FORMAT_MSG_NO_LOOKUPS env variable in OpenShift (f.e. through oc set env), instead of specifying the log4j2.formatMsgNoLookups system property, a valid mitigation for log4j2 2.10+?
Yes, this is the advised method for OpenShift linked in this article from the Mitigation section on our CVE page:
https://access.redhat.com/solutions/6578421
java-sig-commits@lists.fedoraproject.org