3 ms·
Log4j 1.x is safe from THIS exploit, but reading https://logging.apache.org/log4j/1.2/ https://logging.apache.org/log4j/1.2/, there was an exploit discovered 2
by kyrra 5y ago
Log4j 1.x is safe from THIS exploit, but reading https://logging.apache.org/log4j/1.2/ https://logging.apache.org/log4j/1.2/, there was an exploit discovered 2 years ago that was never fixed on the official branch (https://www.cvedetails.com/cve/CVE-2019-17571/ https://www.cvedetails.com/cve/CVE-2019-17571/). There is a workaround of disabling SocketServer so it won't be exploitable, but I believe 1.2.17 still has an RCE in it by default.
- cesarb 5y ago> There is a workaround of disabling SocketServer so it won't be exploitable, but I believe 1.2.17 still has an RCE in it by default. Sorry if I'm being dense, but wouldn't the workaround be not enabling SocketServer? AFAIK, it's not used by default, it's something you have to decide to use explicitly.