3 ms·
We use a decade+ old version of log4net. It suits us just fine and I’m not even sure “vulns” are something we would need to care about in debug logging software
by jimbob45 6y ago
We use a decade+ old version of log4net. It suits us just fine and I’m not even sure “vulns” are something we would need to care about in debug logging software.
- cmckn 6y agoI think “vulnerabilities” are always worth thinking through like this. If a YAML library you only use to read in a config file at startup has some buffer overflow bug...who cares? It’s usually painless to just bump the version, but just because a bug was fixed doesn’t mean you’re now insecure.
- bryanrasmussen 6y agoIt certainly doesn't look like there are a lot of problems https://www.cvedetails.com/product/7281/Apache-Log4net.html?vendor_id=45 https://www.cvedetails.com/product/7281/Apache-Log4net.html?...