4 ms·
Java is only used in the App Store upload tool, I suppose you’d need to build an untrusted project and then upload it to the store? Not very likely.
by mrpippy 5y ago
Java is only used in the App Store upload tool, I suppose you’d need to build an untrusted project and then upload it to the store?
Not very likely.
- jeroenhd 5y agoThere might be a vulnerability there if you use one of those SaaS tools that turn websites into apps for you. Some (early?) versions gave you the binaries that you'd just need to sign and upload yourself. In those circumstances, the insecure and outdated code can trigger and take over your machine. I don't think it's a big problem in practice, really. The Java version listed is already several outdated so I don't think log4j is the only security problem the uploading system introduces. I'm not sure why Apple isn't shipping a supported, patched JRE instead of their own bespoke implementation, but they seem to be behind on patches as a result.