Log4J CVE Mitigation for Neo4j

General Announcements
, , ,
2

Update:

We now have an official page with ongoing updates here

New releases are out, which upgraded the log4j dependency to a non-vulnerable version (2.15.0)
also on DockerHub

  • 4.4.1
  • 4.3.8
  • 4.2.12

Please upgrade to these new releases

If you can not upgrade use the mentioned mitigation.

For a more drastic mitigation you can also remove the JndiLookup class from the neo4j-logging.jar
Might need to install zip first on your systems.

zip -q -d /usr/share/neo4j/lib/neo4j-logging-4*.jar org/neo4j/logging/shaded/log4j/core/lookup/JndiLookup.class
2 Likes