2 ms·
As others pointed out that comment was after the cve was created.
by AnotherGoodName 4y ago
As others pointed out that comment was after the cve was created.
- shagie 4y agoThe comment is, but the start of the PR (by a person from the Apache Foundation org) matches matches the "we told Apache" date. The "all hell broke lose" starts with that comment. Note that the LDAP part wasn't sufficient to fully excise the security vulnerability.
- AnotherGoodName 4y ago24th Nov reported by Alibaba and the 30th this conversation starts in response to the heads up right.
- shagie 4y agoI believe the timeline is: Nov 24 - Wednesday - Report of issue Nov 25 - Thursday - Thanksgiving Nov 29 - Monday - Work done Nov 30 - Tuesday - PR submitted (review as if nothing special) Dec 9 - Thursday - "Is it a security vulnerability?" Dec 10 - Friday - All hell breaks loose (Log4j 2.15.0 released) Dec 13 - Monday - Java devs updating libraries furiously (Log4j 2.16.0 released) Dec 18 - Saturday - Wait? there's more (Log4j 2.17.0 released) ... Dec 27 - Monday - Enough already (Log4j 2.17.1 released)