News for hackers. Stuff that matters.

A comment on Log4j RCE Found. Parent comment

Re:Log4j RCE Found by agwa on Thursday December 09, 2021 @10:44PM (#29506162)
> the vulnerable feature is not in log4j < 2.10

The comment you cited is referring to the option to disable the vulnerable feature, not the vulnerable feature itself.

Per https://github.com/apache/logging-log4j2/pull/608#issuecomme... even log4j 1.x is vulnerable.

[ Parent | on HN ]
Re:Log4j RCE Found by tmd83 on Thursday December 09, 2021 @11:50PM (#29506521)
Does that mean it's only vulnerable if JMSAppender is used otherwise not? Which should at least be a rarer use case.
[ Parent | on HN ]
Re:Log4j RCE Found by philipwhiuk on Saturday December 11, 2021 @09:39AM (#29521151)
Log4J 1 is only vulnerable for JMS Log4J 2 is vulnerable < 2.15.0. There are mitigations for > 2.10.0 and > 2.7.0
[ Parent | on HN ]
Re:Log4j RCE Found by cesarb on Thursday December 09, 2021 @11:22PM (#29506358)
What I understood from that comment is that log4j 1.x is only vulnerable if you use the JMS Appender, which is probably not the most common configuration.
[ Parent | on HN ]