Technote on Log4j vulnerability in Informix
Carlton Doe announced an official TechNote on the Log4j vulnerability CVE-2021-44228 in Informix, affecting the latest InformixHQ versions with a simple workaround. Stefan Wilfling and Oyvind Gjerstad noted the formatMsgNoLookups setting no longer suffices without log4j 2.17.0; Martin Graney called it a mitigation. Carlton said development would publish an official response.
Auto-generated by Claude from the posts below — may be imperfect; read the full thread.
An official TechNote is now available on this issue. The full Security Bulletin will be published (with the same information) through the PSIRT channels shortly. Tech Note: Log4j Vulnerability ( CVE-2021-44228 ) in IBM Informix workaround Basically it affects the latest IHQ versions. Workaround is very simple to implement. Thank you to Informix Development for working on this. ------------------------------ Carlton Doe ------------------------------ #Informix
Thanks for the information! ------------------------------ SangGyu Jeong Software Engineer Infrasoft Seoul Korea, Republic of ------------------------------
Hi! Be careful, because the solution (-Dlog4j2.formatMsgNoLookups=true) is out of date. Look at: https://logging.apache.org/log4j/2.x/ : Without updating to log4j 2.17.0, it doesn´t help in all cases. ------------------------------ Kind Regards Stefan ------------------------------
Development is looking at this and we'll publish an official response as soon as we can. Thanks ------------------------------ Carlton Doe ------------------------------
Stefan: Why is -Dlog4j2.formatMsgNoLookups=true out of date? This is a mitigation not a remediation. Log4J2 version 2.17 didn't exist three days ago. -Dlog4j2.formatMsgNoLookups=true works to mitigate the issues until Developement can build a new release of software with Log4J 2.17.0. ------------------------------ Best regards, Martin Graney Queues Enforth Development, Inc. Woburn, MA 01801 ------------------------------
Because there are now published exploits for which this property does not help ------------------------------ Øyvind Gjerstad Developer/Architect PostNord AS ------------------------------