News for hackers. Stuff that matters.

A comment on Log4j RCE Found. Parent comment

Re:Log4j RCE Found by throw_nbvc1234 on Thursday December 09, 2021 @11:13PM (#29506307)
Which is why they removed the functionality in the latest version (per comments below) right?
[ Parent | on HN ]
Re:Log4j RCE Found by tmm1 on Friday December 10, 2021 @12:12AM (#29506646)
Not removed: https://github.com/apache/logging-log4j2/commit/d82b47c6fae9...
[ Parent | on HN ]
Re:Log4j RCE Found by Quekid5 on Friday December 10, 2021 @09:24AM (#29510165)
Holy moley, that's a lot of extra code... any bets on if it might contain new vulnerabilities? :)
[ Parent | on HN ]
Re:Log4j RCE Found by justinpombrio on Sunday December 19, 2021 @04:04PM (#29618403)
Hahaha, giving you an upvote because new vulnerabilities have, in fact, been found. (And I think one of them relates to this new code not being sufficient? Though I'm not following much anymore.)
[ Parent | on HN ]
Re:Log4j RCE Found by scottlamb on Friday December 10, 2021 @04:35PM (#29515730)
There are two bizarre design decisions that combined into this stunning security vulnerability: the automatic trust-the-world code execution (on by default) and the recursive parameter expansion (always on). They flipped the default on the former. They haven't done anything about the latter, AFAIK. I wonder if they will.
[ Parent | on HN ]