4 ms·
It's horrible that the vuln is fixed in open PR, never assigned CVE, and never released fixed version unless 0day shown in wild.
by fomine3 5y ago
It's horrible that the vuln is fixed in open PR, never assigned CVE, and never released fixed version unless 0day shown in wild.
- philipwhiuk 5y ago1. I believe that the zero day was released before the fix 2. There's no practical way to responsibly disclose a bug in a core library
- 88joshgree 5y agoNah there was a PR to mitigate in 2016 -> https://issues.apache.org/jira/browse/LOG4J2-2109 https://issues.apache.org/jira/browse/LOG4J2-2109
- 88joshgree 5y agoYeah and by someone who works for palantir no less - wonder how long they have been using it!?