Mitigate potential Remote-Code-Execution caused by CVE-2021-44228 (#1343

) Signed-off-by: Flole <[email protected]>
openhab · Dec 11, 2021 · 3a6df5c · 3a6df5c
1 parent 8964c6a
commit 3a6df5c
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/distributions/openhab/src/main/resources/bin/setenv b/distributions/openhab/src/main/resources/bin/setenv
@@ -110,7 +110,8 @@ export JAVA_OPTS="${JAVA_OPTS}
   -Dorg.apache.cxf.osgi.http.transport.disable=true
   -Dorg.ops4j.pax.web.listening.addresses=${HTTP_ADDRESS}
   -Dorg.osgi.service.http.port=${HTTP_PORT}
-  -Dorg.osgi.service.http.port.secure=${HTTPS_PORT}"
+  -Dorg.osgi.service.http.port.secure=${HTTPS_PORT}
+  -Dlog4j2.formatMsgNoLookups=true"
 
 #
 # set JVM options

diff --git a/distributions/openhab/src/main/resources/bin/setenv.bat b/distributions/openhab/src/main/resources/bin/setenv.bat
@@ -127,7 +127,8 @@ set JAVA_OPTS=%JAVA_OPTS% ^
   -Dorg.apache.cxf.osgi.http.transport.disable=true ^
   -Dorg.ops4j.pax.web.listening.addresses=%HTTP_ADDRESS% ^
   -Dorg.osgi.service.http.port=%HTTP_PORT% ^
-  -Dorg.osgi.service.http.port.secure=%HTTPS_PORT%
+  -Dorg.osgi.service.http.port.secure=%HTTPS_PORT% ^
+  -Dlog4j2.formatMsgNoLookups=true
 
 :: set jvm options
 set EXTRA_JAVA_OPTS=-XX:+UseG1GC ^