3 ms·

the vulnerable feature is not in log4j < 2.10 see https://github.com/apache/logging-log4j2/pull/608#issuecomment-990305306 https://github.com/apache/logging-lo

• agwa 5y ago
  > the vulnerable feature is not in log4j < 2.10 The comment you cited is referring to the option to disable the vulnerable feature, not the vulnerable feature itself. Per https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126 https://github.com/apache/logging-log4j2/pull/608#issuecomme... even log4j 1.x is vulnerable.
  • cesarb 5y ago
    What I understood from that comment is that log4j 1.x is only vulnerable if you use the JMS Appender, which is probably not the most common configuration.
  • tmd83 5y ago
    Does that mean it's only vulnerable if JMSAppender is used otherwise not? Which should at least be a rarer use case.
    • philipwhiuk 5y ago
      Log4J 1 is only vulnerable for JMS Log4J 2 is vulnerable < 2.15.0. There are mitigations for > 2.10.0 and > 2.7.0
• nick__m 5y ago
  please ignore my comment on the version, agwa is right, update the library or delete the vulnerable class.