4 ms·
No, JNDI is an API for accessing remote code. It stands for Java Naming and Directory Interface. Not supporting LDAP, the most common remote directory, would
by drdec 5y ago
No, JNDI is an API for accessing remote code. It stands for Java Naming and Directory Interface. Not supporting LDAP, the most common remote directory, would have been a flaw.
The flaw was in log4j's use of the library which allowed remotely connecting and executing code by default based on connection strings which were possibly user-entered.
- reyqn 5y agoOk so JNDI's purpose is actually accessing remote code. You just have to not give it any untrusted data. It seems like a dangerous tool to use.