

The answer was in how the package’s package identifier was set up. SapMachine Java 17 LTS installed, then SapMachine Java 11 LTS is installed.



Once downloaded and uncompressed, you should have the following files: The files to download are one of the following two:īoth have the same contents, the main difference is how they are compressed. Jamf has stated that they have evaluated CVE-2021-45046, which prompted the release of 2.16.0, and the results of their evaluation are that it does not appear that the conditions which are covered by CVE-2021-45046 should occur with Jamf’s products.Īs of December 15th 2021, Jamf has not provided guidance on updating from log4j 2.15.0 to log4j 2.16.0 Insecure JNDI lookups are what enable the Log4Shell vulnerability, so having JNDI disabled by default in addition to 2.16.0’s removal of its message lookups functionality fixes the vulnerability. Log4j 2.16.0 has been released to address remaining vulnerabilities in 2.15.0 by completely disabling Java Naming and Directory Interface (JNDI) lookups by default. It’s log4j 2.1.5 and is available for download via the link below: To address this vulnerability, the log4j folks have released an updated version of the logging tool which is not vulnerable. My colleague Ben Toms has a good write up on this issue here: wouldn't it be ✨ amazing ✨ if we all just promised to be nice and instead use this power to make vanilla minecraft doom server 🤔 /tCaUCG1dqg So fixing log4shell is great and all, but.
