4 ms·
Was there not a flaw in the jndi api for ldap? log4j was just the entry point from what I understood.
by reyqn 5y ago
Was there not a flaw in the jndi api for ldap? log4j was just the entry point from what I understood.
- drdec 5y agoNo, JNDI is an API for accessing remote code. It stands for Java Naming and Directory Interface. Not supporting LDAP, the most common remote directory, would have been a flaw. The flaw was in log4j's use of the library which allowed remotely connecting and executing code by default based on connection strings which were possibly user-entered.
- reyqn 5y agoOk so JNDI's purpose is actually accessing remote code. You just have to not give it any untrusted data. It seems like a dangerous tool to use.