Which one is correct?
-Dlog4j.formatMsgNoLookups=true
-Dlog4j2.formatMsgNoLookups=true
Or both are working?
Ref:
log4j: https://dev.to/composite/how-to-pass-the-log4j2-vulnerability-quick-453h
log4j2: 1) https://spring.io/blog/2021/12/10/log4j2-vulnerability-and-spring-boot
2) https://www.cvedetails.com/cve/CVE-2021-44228/
N) and many more...
Edit: As remarked by Markono1234 this particular property was introduced in Log4j 2.10 and the only correct form is log4j2.formatMsgNoLookups (cf. source code).
Most remaining properties have two forms: a pre-2.10 log4j.* legacy property name and a new normalized log4j2.* name. See Log4j system properties for details:
Note that beginning in Log4j 2.10, all system property names have been normalized to follow a consistent naming scheme. While the old property names are still supported for backwards compatibility, it is recommended to update configurations to use the new style.
