3 ms·
Can anyone explain how this would be exploited and its actual risk level? I understand the log4j2 cve -- craft some input so that log4j does a lookup and inser
by bfung 5y ago
Can anyone explain how this would be exploited and its actual risk level?
I understand the log4j2 cve -- craft some input so that log4j does a lookup and insert your arbitrary code there.
But how does this being in XCode present a risk and what level of risk?
Is someone running XCode in a production server somewhere? The most likely case I could think of would be in a CI type server, and this would only be vulnerable when a build is getting is in progress?
It's not on the level of "my app runs on tomcat" type of bad, I wouldn't think.
- elpakal 5y agoAll a guess, but I think this impacts CI providers more than anything because they are running Xcode for arbitrary projects. If I were a CI provider I’d probably be nervous. And also once Xcode is patched, all of our teams are going to have to update immediately and that wipes out a whole day of work. But again, just guessing here.
- gregoriol 5y agoIf the CI runs the build of arbitrary projects, it already has a huge vector surface for attacks: xcode projects can contain shell scripts, ... So xcode's App Store submission components having log4j won't likely allow for more exploits of CIs or local devices