Apiman 2.1.3 is out (update promptly)

[msavy]

As many of you likely are aware by now, log4j2 has a CVE which can be exploited in a range of circumstances (of varying plausibility).

I've released Apiman 2.1.3.Final to bump our log4j2 dependency to a version with a fix for the issue.

https://github.com/apiman/apiman/releases/tag/2.1.3.Final

[volkflo]

Great!

[iamakashk]

As many of you likely are aware by now, log4j2 has a CVE which can be exploited in a range of circumstances (of varying plausibility).

I've released Apiman 2.1.3.Final to bump our log4j2 dependency to a version with a fix for the issue.

https://github.com/apiman/apiman/releases/tag/2.1.3.Final

Hey @msavy
I am on v2.1.0.Final. With this version I have made few changes in the code and then I have deployed it. Could you please suggest log4j related changes for this version ?

[msavy]

Either rebase onto the latest Apiman or you could use the mitigation by setting the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS=true

e.g. using your shell… export LOG4J_FORMAT_MSG_NO_LOOKUPS=true

Or a Java system property: ‐Dlog4j2.formatMsgNoLookups=true

In Docker use the --env LOG4J_FORMAT_MSG_NO_LOOKUPS=true

[msavy]

(You'll likely need to restart your instance unless you use one of these hot-patching projects, but that's outside of the scope of the suggestions given here)