News for hackers. Stuff that matters.

A comment on Log4j RCE Found. Parent comment

Re:Log4j RCE Found by fauria on Friday December 10, 2021 @05:42AM (#29508437)
> I'm still not quite sure why LDAP comes into the picture

According to https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-... , SecurityManager is not enforced on remote class loading when using JNDI's LDAP server provider interface.

[ Parent | on HN ]
Re:Log4j RCE Found by isbvhodnvemrwvn on Friday December 10, 2021 @06:37AM (#29508710)
Let's be honest, barely anyone even uses SecurityManager in the real world.
[ Parent | on HN ]
Re:Log4j RCE Found by jsiepkes on Friday December 10, 2021 @06:42AM (#29508752)
There is even a JEP to remove the SecurityManager all together: https://openjdk.java.net/jeps/411
[ Parent | on HN ]
Re:Log4j RCE Found by feurio on Friday December 10, 2021 @06:55AM (#29508848)
There is even a JEP to remove the SecurityManager!
[ Parent | on HN ]