4 ms·
What surprises me is the scoring... for a non-default config. Seems a little high, but these seem inflated, maybe just because of the attention.
by spydum 5y ago
What surprises me is the scoring... for a non-default config. Seems a little high, but these seem inflated, maybe just because of the attention.
- smarx007 5y agoI think the scoring is done from the assumption that many users may be concatenating a log string instead of formatting it. If you format your log strings, 7.5 is definitely too high.
- majou 5y agoThe scoring has little merit in general.
- terom 5y agoParticularly with the `${ctx:...}` vs `%X{...}` distinction. For a plain DoS, which only affects `${ctx:...}` usage? I wouldn't panic, fix it if someone manages to actually exploit it... It's goods new so far that with more people/time and attention paid to the log4j exloits, the vulnerabilities are just getting narrower in scope and lesser in impact.