3 ms·
I thought Log4j 1.1 was vulnerable, just to a lesser extent, and there wasn't a lot of information on it because 1.x is end of life
by thayne 4y ago
I thought Log4j 1.1 was vulnerable, just to a lesser extent, and there wasn't a lot of information on it because 1.x is end of life
- bragr 4y agoLog4j 1.x is vulnerable, but to different things and not as badly.
- cesarb 4y ago> Log4j 1.x is vulnerable, but to different things And the most common use of log4j 1.x (logging to the console or to a file, with a simple configuration) uses none of the vulnerable parts.
- Natsu 4y agoEOL libraries are themselves vulnerabilities. It's not really good to even have this reachable on the classpath, in cases like the grandparent, you should look at removing the class from inside the JAR (or removing the JAR itself) if possible to ensure that the vulnerable code cannot get called under any circumstances.
- hyperman1 4y agoSee https://logging.apache.org/log4j/1.2/ https://logging.apache.org/log4j/1.2/ . Plenty of vulnerabilities. Just different ones
- Danidada 4y agoSomeone said "hey log4j 1.2 wasn't that bad" after the log4shell vuln and came up with the idea of reload4j which is just log4j 1.2 but with its known vulnerabilities, bugs and performance issues fixed. Complete feature freeze besides that. Considering that a log tool shouldn't have that many features and that log4j 1.2 was being used by a lot of companies (just see maven central stats) there is no need to add more features to reload4j, which I find kind of cool