4 ms·

It started here https://github.com/apache/logging-log4j2/pull/608#issuecomment-989762094 https://github.com/apache/logging-log4j2/pull/608#issuecomme... and was

by shagie 4y ago

It started here https://github.com/apache/logging-log4j2/pull/608#issuecomment-989762094 https://github.com/apache/logging-log4j2/pull/608#issuecomme... and was rapidly recognized that this impacted almost everything. Minecraft servers were one of the most accessible places to use the exploit and at the same time, some of the ones that are least likely to patch updates rapidly.

AnotherGoodName 4y ago
As others pointed out that comment was after the cve was created.
- shagie 4y ago
  The comment is, but the start of the PR (by a person from the Apache Foundation org) matches matches the "we told Apache" date. The "all hell broke lose" starts with that comment. Note that the LDAP part wasn't sufficient to fully excise the security vulnerability.
  - AnotherGoodName 4y ago
    24th Nov reported by Alibaba and the 30th this conversation starts in response to the heads up right.
    - shagie 4y ago
      I believe the timeline is: Nov 24 - Wednesday - Report of issue Nov 25 - Thursday - Thanksgiving Nov 29 - Monday - Work done Nov 30 - Tuesday - PR submitted (review as if nothing special) Dec 9 - Thursday - "Is it a security vulnerability?" Dec 10 - Friday - All hell breaks loose (Log4j 2.15.0 released) Dec 13 - Monday - Java devs updating libraries furiously (Log4j 2.16.0 released) Dec 18 - Saturday - Wait? there's more (Log4j 2.17.0 released) ... Dec 27 - Monday - Enough already (Log4j 2.17.1 released)