# Log4J CVE Mitigation for Neo4j -\> "The docker images have also been updated with a config setting disabling jmx."

**URL:** <https://community.neo4j.com/t/log4j-cve-mitigation-for-neo4j-the-docker-images-have-also-been-updated-with-a-config-setting-disabling-jmx/48926>\
**Category:** Server\
**Created:** [December 13, 2021, 8:51am UTC](https://community.neo4j.com/t/log4j-cve-mitigation-for-neo4j-the-docker-images-have-also-been-updated-with-a-config-setting-disabling-jmx/48926 "2021-12-13T08:51:11Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bleimehl](https://sea1.discourse-cdn.com/flex021/user_avatar/community.neo4j.com/bleimehl/32/21389_2.png) [@bleimehl](https://community.neo4j.com/u/bleimehl)\
**Post date:** [December 13, 2021, 8:51am UTC](https://community.neo4j.com/t/log4j-cve-mitigation-for-neo4j-the-docker-images-have-also-been-updated-with-a-config-setting-disabling-jmx/48926/1 "2021-12-13T08:51:11Z")

</div>

# [Log4J CVE Mitigation for Neo4j](https://community.neo4j.com/t/log4j-cve-mitigation-for-neo4j/48856)

@michael.hunger says that the Docker images are updated to mitigate the problem

"The docker images have also been updated with a config setting disabling jmx."

Is that true? On dockerhub the 4.4 images are still 6 days old and the 4.3 even 10 days

> **[neo4j - Official Image | Docker Hub](https://hub.docker.com/_/neo4j?tab=tags)**
>
> Neo4j is a highly scalable, robust native graph database.

---

<div class="post-metadata">

**Author:** ![michael.hunger](https://sea1.discourse-cdn.com/flex021/user_avatar/community.neo4j.com/michael.hunger/32/27377_2.png) [@michael.hunger](https://community.neo4j.com/u/michael.hunger)\
**Post date:** [December 13, 2021, 4:40pm UTC](https://community.neo4j.com/t/log4j-cve-mitigation-for-neo4j-the-docker-images-have-also-been-updated-with-a-config-setting-disabling-jmx/48926/2 "2021-12-13T16:40:26Z")

</div>

It seems that they had jmx access already disabled

If you do

```auto
call dbms.listConfig() yield name, value 
where name starts with "dbms.jvm.additional" 
return name, value

```

it shows this which includes the disabled log4j jmx `-Dlog4j2.disable.jmx=true`

```auto
-XX:-OmitStackTraceInFastThrow
-XX:+AlwaysPreTouch
-XX:+UnlockExperimentalVMOptions
-XX:+TrustFinalNonStaticFields
-XX:+DisableExplicitGC
-XX:MaxInlineLevel=15
-XX:-UseBiasedLocking
-Djdk.nio.maxCachedBufferSize=262144
-Dio.netty.tryReflectionSetAccessible=true
-Djdk.tls.ephemeralDHKeySize=2048
-Djdk.tls.rejectClientInitiatedRenegotiation=true
-XX:FlightRecorderOptions=stackdepth=256
-XX:+UnlockDiagnosticVMOptions
-XX:+DebugNonSafepoints
-Dlog4j2.disable.jmx=true"

```

---

<div class="post-metadata">

**Author:** ![bleimehl](https://sea1.discourse-cdn.com/flex021/user_avatar/community.neo4j.com/bleimehl/32/21389_2.png) [@bleimehl](https://community.neo4j.com/u/bleimehl)\
**Post date:** [December 13, 2021, 4:46pm UTC](https://community.neo4j.com/t/log4j-cve-mitigation-for-neo4j-the-docker-images-have-also-been-updated-with-a-config-setting-disabling-jmx/48926/3 "2021-12-13T16:46:58Z")

</div>

Thanks Michael for the clarification:

Additional hint:

if you use `NEO4J_dbms_jvm_additional` you will overwrite these default and you have to set them yourself

---

<div class="post-metadata">

**Author:** ![michael.hunger](https://sea1.discourse-cdn.com/flex021/user_avatar/community.neo4j.com/michael.hunger/32/27377_2.png) [@michael.hunger](https://community.neo4j.com/u/michael.hunger)\
**Post date:** [December 13, 2021, 5:45pm UTC](https://community.neo4j.com/t/log4j-cve-mitigation-for-neo4j-the-docker-images-have-also-been-updated-with-a-config-setting-disabling-jmx/48926/4 "2021-12-13T17:45:36Z")

</div>

Yes I realized that only after the fact which is a bit annoying.  
The other option one can use with Docker is to set this environment variable:

`ENV LOG4J_FORMAT_MSG_NO_LOOKUPS=true`