You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@logging.apache.org by rp...@apache.org on 2021/12/16 03:22:58 UTC
[logging-log4j2] branch release-2.x updated: [DOC] fix incorrect spelling of formatMsgNoLookups sysprop
This is an automated email from the ASF dual-hosted git repository.
rpopma pushed a commit to branch release-2.x
in repository https://gitbox.apache.org/repos/asf/logging-log4j2.git
The following commit(s) were added to refs/heads/release-2.x by this push:
new 7a66ad0 [DOC] fix incorrect spelling of formatMsgNoLookups sysprop
7a66ad0 is described below
commit 7a66ad08eceb74928a7570de0447253adb803126
Author: rpopma <rp...@apache.org>
AuthorDate: Thu Dec 16 12:22:49 2021 +0900
[DOC] fix incorrect spelling of formatMsgNoLookups sysprop
---
src/site/markdown/index.md.vm | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/site/markdown/index.md.vm b/src/site/markdown/index.md.vm
index aae4734..8e6fc69 100644
--- a/src/site/markdown/index.md.vm
+++ b/src/site/markdown/index.md.vm
@@ -40,7 +40,7 @@ configuration uses a Pattern Layout with either a Context Lookup (for example, \
Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern
resulting in a denial of service (DOS) attack. Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default.
-Note that previous mitigations involving configuration such as setting the system property `log4j2.noFormatMsgLookup`
+Note that previous mitigations involving configuration such as setting the system property `log4j2.formatMsgNoLookups`
to `true` do NOT mitigate this specific vulnerability.
$h4 Mitigation