How to set Dlog4j2.formatMsgNoLookups=true in JVM?

Question

In one of my computers, there is JRE 1.8.0_45 and in another machine there is OpenJDK.

I want to set the JVM flag Dlog4j2.formatMsgNoLookups=true, but where can I write this piece of configuration?

Answer 1

If possible, upgrade to Log4j version 2.15.0.

If upgrading is not possible, then ensure the -Dlog4j2.formatMsgNoLookups=true system property is set. Use the this command:

java -Dlog4j2.formatMsgNoLookups=true -jar myapp.jar

Also worth reading on mitigation:

• Log4J2 Vulnerability and Spring Boot
• Inside the Log4j2 vulnerability (CVE-2021-44228)