It’s a demonstration in golang of what the vuln is. The assumption (not a bad one) is that golang devs may not be familiar with Java things and happenings. I ca

It’s a demonstration in golang of what the vuln is. The assumption (not a bad one) is that golang devs may not be familiar with Java things and happenings. I can actually use it and simulate what an attacker could do. So it lets golang devs play with the problem. The problem with this vuln is that since this library is a Java library that’s used everywhere, remediation is going to have a really long tail. There are a fuckton of apps that use this logger and it’s owners are not aware of it. Or it’s used in a part of a stack that’s not tracked yet… nobody can really tell.