Qlik GeoAnalytics older versions of Log4j found in jetty-0_0_0_0-80-ravegeo_war subfolder

[Sebastian_Linser]

On a deep scan for log4j files, you might find a hit in a folder called jetty-0_0_0_0-80-ravegeo_war*. Those files are from earlier versions before the fixes had been implemented. E.g. log4j-core-2.13.3.jar.

Resolution

1. Stop the Geoanalytics server and change to the folder you found the files in, the usual ones are listed below
   
   C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\ or c:\users\USERNAMe\appdata\local\temp\
   
   
2. Delete the jetty-0_0_0_0-80-ravegeo_war* subfolders.
   
   
3. Restart the Qlik Geoanalytics Service again.

Cause 

Older versions of Qlik Geoanalytics extracted log4j jar files into 

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\jetty-0_0_0_0-80-ravegeo_war-_ravegeo-any-9094929437680040180\webapp\WEB-INF\lib

or 

c:\users\USERNAMe\appdata\local\temp\jetty-0_0_0_0-8080-ravegeo_war-_ravegeo-any-5388159241656068212.dir\webapp\web-inf\lib\

Environment

• Qlik GeoAnalytics all versions

Related Content

CVE_2021_44228 - Handling the log4j lookups critical vulnerability for Qlik GeoAnalytics