5 ms·
log4j is a very popular and ubiquitous Java library. Having a zero-day remote code execution vulnerability in it is a serious problem that undoubtedly affects a
by johnthuss 5y ago
log4j is a very popular and ubiquitous Java library. Having a zero-day remote code execution vulnerability in it is a serious problem that undoubtedly affects a huge portion of the internet.
- tbarbugli 5y agoVery easy to exploit as well: https://github.com/YfryTchsGD/Log4jAttackSurface https://github.com/YfryTchsGD/Log4jAttackSurface
- deleted 5y ago[deleted]
- cogman10 5y agoIt's almost mind boggling that it went for so long undetected. It's been sitting there for 7 years.
- commandlinefan 5y ago> so long undetected ... that we know of.
- abhishekjha 5y agoSo how was it detected now? Who reported it first and what were they looking for?
- jesstaa 5y ago'Shellshock' was sitting there since 1989 and only detected in 2014.
- tetha 5y agoAfter ~12 hours of getting this mitigated at work, yeah. The only things I could imagine much worse would be broken RSA, or something like this in the linux network stack. Even something in SSHD would be less bad, because SSHDs tend to be protected. This occurs in the main business function of requests.