Page History

...

See the detailed procedure to mitigate the risk concerning the CVE-2021-44228 vulnerability. 

Option 2

If you cannot upgrade log4j, you may add 

...

You may prevent lookups in the log event message by adding parameter via command line or in the <modeling tool>.properties file.

Configuring<modeling tool>.properties file

1. Go to <modeling tool installation directory>\bin and open the modeling tool properties file.

2. In the JAVA_ARGS line add: 

   Code Block
   -Dlog4j.formatMsgNoLookups=true

as a command line option or add

log4j.formatMsgNoLookups=true

to a <modeling tool installation directory>\bin\<modeling tool>.properties file (e.g. magicdraw.properties, csm.properties, cameoea.properties) on the classpath to prevent lookups in the log event message.

...

1. For example:  

   Code Block
   JAVA_ARGS=-Xmx4000M -DLOCALCONFIG\=true -splash\:data/splash.png -Dmd.class.path\=$java.class.path -Dcom.nomagic.osgi.config.dir\=configuration -Desi.system.config\=data/application.conf -Dlogback.configurationFile\=data/logback.xml -Dsun.locale.formatasdefault\=true -Dinitial.user.language\=en -Xss1024K -Dlog4j.formatMsgNoLookups=true

   
   

2. Save and close the file.
3. Restart your modeling tool.
   
   

For collaboration tools (Magic Collaboration Studio, Cameo Collaborator for Teamwork Cloud, Teamwork Cloud)

Option 1

You may prevent  lookups prevent lookups in the log event message by adding parameter via command line or in Web Application Platform setenv.sh / setenv.bat properties file.

...