4 ms·

Actually, Elasticsearch was completely unaffected by log4shell precisely because they implemented JVM sandboxing which completely mitigated it: https://discuss.

• vbezhenar 4y ago
  Java Security Manager is deprecated in Java 17 and is likely to be removed in the future releases. So better approach is to use container security or something like that.
  • fulafel 4y ago
    The deprecation JEP has some discussion of why it was deprecated: https://openjdk.org/jeps/411 https://openjdk.org/jeps/411 "The threat of accidental vulnerabilities in local code is almost impossible to address with the Security Manager. Many of the claims that the Security Manager is widely used to secure local code do not stand up to scrutiny; it is used far less in production than many people assume. There are many reasons for its lack of use: [...]" Would be interesting to know if there were other cases besides ElasticSearch that were protected from log4j by JSM.
    • pjmlp 4y ago
      .NET also dropped CAS during the Core rewrite, with similar reasoning. Which is a pity, but unfortunely capability based systems still seem to have a problem for the common developer to properly configure them.