For hosted customer please raise a new case online and reference the title of this article.
For non-hosted
Summary
A critical vulnerability has been identified in a third-party component (Apache Log4j), which is currently used within Mosaic. The vulnerability is identified as CVE-2021-44228 - remote code execution vulnerability in Apache Log4j.
If you’re running an older release of Mosaic, such as 5.15 or 5.16, you don’t need to take any action as the affected class-file is not used in these versions of the third-party library.
The log4j library version has been uplifted to 2.17.0 in Mosaic 22.1.0.0 and therefore the workaround is not required from Mosaic version 22.1.0.0 or later.
The log4j 1.2.x jar is still shipped with Mosaic in this version but the log file entries will now come from log4j 2, the library will be completely removed in a future release.
Workaround
Add the following WebLogic server start argument to all Mosaic managed servers.
In Weblogic go to Environment, then go to Servers.
Select the relevant server.
Click the Server Start tab.
Update the contents of the arguments field by adding the following:
-Dlog4j2.formatMsgNoLookups=true
📌 Note: The Weblogic managed server, not the VM, will require a restart before the change takes effect.