3 ms·
Does anyone know why one is protected with higher Java versions? I parsed the vuln as being solely in the log4j library.
by chopin 5y ago
Does anyone know why one is protected with higher Java versions? I parsed the vuln as being solely in the log4j library.
- bzzzt 5y agoNewer Java versions disable deserialization of remote classes via LDAP. You're still vulnerable to deserialization of existing classes, but to exploit that there have to be exploitable classes on the classpath already.
- toyg 5y agoLog4j2 uses some JVM features to resolve some addresses, and these features can end up blindly loading external classes in the affected JVMs. Note that non-affected JVMs are still vulnerable to other issues triggered by that resolution process, just not as bad as loading untrusted remote objects. So you should upgrade log4j2 even if you use a non-vulnerable JVM.