Log4J exploit and VM parameter log4j2.formatMsgNoLookups https://liferay.dev/c/message_boards/find_thread?p_l_id=119785294&threadId=121296261 2026-04-06T18:11:29Z 2026-04-06T18:11:29Z Andre Albert https://liferay.dev/c/message_boards/find_message?p_l_id=119785294&messageId=121297650 2021-12-14T14:53:27Z 2021-12-14T14:53:27Z

<p>Many thanks Tomas for clarification on this.</p> <p>Best regards Andre</p>

Andre Albert 2021-12-14T14:53:27Z Tomáš Polešovský https://liferay.dev/c/message_boards/find_message?p_l_id=119785294&messageId=121296345 2021-12-14T14:52:33Z 2021-12-13T20:38:16Z

<p>Hello Andre,</p> <p>I just tried and any of them works and protects:</p> <pre> -DLog4j2.formatMsgNoLookups=true</pre> <pre> -Dlog4j2.formatMsgNoLookups=true</pre> <p>Log4j has a special lookups tables ... <a href="https://github.com/apache/logging-log4j2/blob/50979afd30cb575ba743c25847b62f52414b1d3a/log4j-api/src/main/java/org/apache/logging/log4j/util/PropertiesUtil.java#L482-L498">https://github.com/apache/logging-log4j2/blob/50979afd30cb575ba743c25847b62f52414b1d3a/log4j-api/src/main/java/org/apache/logging/log4j/util/PropertiesUtil.java#L482-L498</a></p>

Tomáš Polešovský 2021-12-13T20:38:16Z Andre Albert https://liferay.dev/c/message_boards/find_message?p_l_id=119785294&messageId=121296260 2021-12-13T18:35:36Z 2021-12-13T18:35:36Z

<p>Hello,</p> <p>Liferay wrote an article about the log4j eploit (https://help.liferay.com/hc/en-us/articles/4416190497805) and one statement is that setting the VM Launch parameter </p> <pre> -DLog4j2.formatMsgNoLookups=true</pre> <p>will fix it.</p> <p>Is it save to have it with an uppercased L because on the web, it is said that </p> <pre> -Dlog4j2.formatMsgNoLookups=true</pre> <p>will fix it. As far as i know, System parameters are case sensitive. So it save, or should i rather use the lowercase log4j2.formatMsgNoLookups?</p>

Andre Albert 2021-12-13T18:35:36Z