2 ms·

Thanks for the correction. I am not convinced however, if Alibaba ships a single product with Log4J it would be their own product too.

• rfoo 5y ago
  See my sibling comment, if "the product" != log4j, Alibaba is then not required to report that log4j had a vulnerability. Do you mean by redistributing log4j they became a "network product provider" of log4j?
  • sudosysgen 5y ago
    Either that, or that one of their own products is vulnerable because of the Log4J vulnerability.
    • deleted 5y ago
      [deleted]