topic Log4j in Qlik Replicate

Log4j

PerJansdal — Mon, 20 Dec 2021 06:13:56 GMT

Hello

I have added ‐Dlog4j2.formatMsgNoLookups=true to REPENDCTL.BAT on all my QLIK Replicate Servers without problems.

But our security department send me this

Opgrade to Log4j 2.15 is not enough.

The published vulnerrability is CVE-2021-4101 and 45046

Please check

Log4Shell Update: Severity Upgraded 3.7 -> 9.0 for Second log4j Vulnerability (CVE-2021-45046) | LunaSec

Regards

Per Jansdal

Semler IT

Denmark

Re: Log4j

Maria_Halley — Mon, 20 Dec 2021 09:08:20 GMT

@PerJansdal

I will move this to the Qlik Replicate board, so it reaches the right audience

Re: Log4j

PerJansdal — Mon, 20 Dec 2021 09:10:59 GMT

Thank You very much

Re: Log4j

Heinvandenheuvel — Mon, 20 Dec 2021 16:32:03 GMT

The LOG4J module comes into play with the Replicate Endpoint Service only (today).

Best I know this Service is only required when using MongoDB, Salesforce or SAP (and NULL?) endpoints (today).

If you do not need those endpoints then you might consider restarting the Attunity Replicate service after completely disabling that service by making sure that the file replicate\bin\repctl.cfg has a line with < "disable_endpoint_server":true, >

hth,

Hein.

Re: Log4j

PerJansdal — Tue, 21 Dec 2021 06:02:41 GMT

After adding disable_endpoint_server":true to the repctl.cfg file I did restart the Attunity Replicate servive

Regards Per Jansdal