Log4j / Log4Shell Vulnerabilities

7. Mitigation Options

Table 5. Mitigations

Mitigation	Approach	Effective	Notes
Option 1	Disable lookup feature	No	Not effective
Option 2	Disable lookups in log pattern	No	Must be combined with Option 3
Option 3	Remove problematic class	Yes
Option 4	Upgrade to Log4j2 2.17.0	Yes

7.1 Option 1: Disable message format lookups

Option 1 is ineffective

✕

7.2 Option 2: Update logging message format

Must be combined with Option 3

✕

This change disables message format lookups for individual log configurations.

Configuration macro:

{nolookups}

The vulnerability is mitigated from exploitation by updating logging configuration file:

etc/org.ops4j.pax.logging.cfg

Before:

log4j2.pattern = %d{ISO8601} | %-5p | %-16t | %-32c{1} | %X{bundle.id} - %X{bundle.name} - %X{bundle.version} | %m%n

After

log4j2.pattern = %d{ISO8601} | %-5p | %-16t | %-32c{1} | %X{bundle.id} - %X{bundle.name} - %X{bundle.version} | %m{nolookups}%n

This needs to be changed for every pattern used

✕

7.3 Option 3: Remove JndiLoookup class

This removes the class from the installation to prevent exploitation.

This does not effect logging moving forward, as Log4j2 quietly skips lookups when this class is missing.

Steps:

1. Identify the Log4j bundle id

karaf@root()> list -t 0 | grep -i log4j
 7 │ Active   │   8 │ 1.11.9			│ OPS4J Pax Logging - Log4Jv2
implementation, Fragments: 14
14 │ Resolved │  12 │ 1.11.9			│ OPS4J Pax Logging - Log4j v2 Extra
packages, Hosts: 7
karaf@root()>

The log4j2 bundle is '7' in this example

2. Confirm the JndiLookup class exists

karaf@root()> classes 7 | grep -i  jndilookup
org/apache/logging/log4j/core/lookup/JndiLookup.class | exported: false
karaf@root()>

3. Stop the process

./bin/stop

4. Remove the class from the system/ folder

$ zip -q -d system/org/ops4j/pax/logging/pax-logging-log4j2/1.11.9/pax-logging-log4j2-1.11.9.jar org/apache/logging/log4j/core/lookup/JndiLookup.class

5. Remove the class from the deployed bundle in the data/cache folder

$ zip -q -d data/cache/bundle7/version0.0/bundle.jar org/apache/logging/log4j/core/lookup/JndiLookup.class

6. Start the process

./bin/start

7. Confirm the class is removed

karaf@root()> classes 7 | grep -i jndilookup
karaf@root()>

7.4 Option 4: Upgrade Log4j2 to 2.17.1

As of 2021-12-21, the Log4j2 2.17.0 release fixes all known security issues.

HYTE is planning on releasing two updates with fixes built-in. This approach provides a buffer from the large changeset introduced in Log4j2 2.16.0 and 2.17.0, (which was understandably rushed to release).

Table 6. HYTE Release Matrix

HYTE Product Version	HYTE OSS Version	Log4j Version	Mitigation
5.2.28	4.2.11.hyte-42113e	2.14.0	Option 2 + 3 (enabled by default)
5.2.30	4.2.14.hyte-42140	2.17.0	Option 4
5.4.0	4.3.5.hyte-43050	2.17.0	Option 4