Log4j

[PerJansdal]

Hello

I have added ‐Dlog4j2.formatMsgNoLookups=true to REPENDCTL.BAT on all my QLIK Replicate Servers without problems.

But our security department send me this

Opgrade to Log4j 2.15 is not enough.

The published vulnerrability is CVE-2021-4101 and 45046

Please check 

Log4Shell Update: Severity Upgraded 3.7 -> 9.0 for Second log4j Vulnerability (CVE-2021-45046) | Lun...

 Regards 

Per Jansdal

Semler IT

Denmark

[Maria_Halley]

@PerJansdal

I will move this to the Qlik Replicate board, so it reaches the right audience

[PerJansdal]

Thank You very much

[Heinvandenheuvel · Accepted solution]

The LOG4J module comes into play with the Replicate Endpoint Service only (today).

Best I know this Service is only required when using MongoDB, Salesforce or SAP  (and NULL?) endpoints (today).

If you do not need those endpoints then you might consider restarting the Attunity Replicate service after completely disabling  that service by making sure that the file replicate\bin\repctl.cfg has a line with < "disable_endpoint_server":true,   >

hth,

Hein.

[PerJansdal]

After adding disable_endpoint_server":true to the repctl.cfg file I did restart the Attunity Replicate servive

Regards Per Jansdal