3 ms·
You're now making me feel better about our decision to exclude the log4j-api from our spring build entirely.
by wing-_-nuts 5y ago
You're now making me feel better about our decision to exclude the log4j-api from our spring build entirely.
- freeqaz 5y agolog4j-api isn't actually a problem (directly). It's the usage of log4j-core that has the JndiManager class that's the injection point for RCE. In the case of the transient dependency, it's further complicated because we've seen that some packages repackage the JARs they depend on... that means that statically analyzing for log4j is very difficult because you can't use hashes (even if you unzip the jar and hash class files directly). I've been working on a scanner for this stuff on GitHub[0], and it's a real pain in the neck lol. Especially for Vendor software that you don't control. 0: https://github.com/lunasec-io/lunasec/tree/master/tools/log4shell https://github.com/lunasec-io/lunasec/tree/master/tools/log4...