News for hackers. Stuff that matters.

A comment on Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide. Parent comment

Re:Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sh... by bob1029 on Monday December 13, 2021 @02:20PM (#29543272)
We are a .NET shop and we are having to review some things regardless of not having any direct references to log4j or even any java source code.

Lots of developer tools happen to use Java - one immediate example we are investigating is Jenkins.

[ Parent | on HN ]
Re:Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sh... by stuff4ben on Monday December 13, 2021 @02:46PM (#29543593)
FWIW, Jenkins does not use Log4j. Some plugins may, and there's a quick way to determine if it does. Go to the script console, enter in "org.apache.logging.log4j.core.lookup.JndiLookup.class.protectionDomain.codeSource" (without the quotes) and if it returns "groovy.lang.MissingPropertyException: No such property: org for class: Script1" then you are not affected.

See https://www.jenkins.io/blog/2021/12/10/log4j2-rce-CVE-2021-4...

[ Parent | on HN ]
Re:Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sh... by bob1029 on Monday December 13, 2021 @02:51PM (#29543686)
Correct - The plugins are the bit we are checking.
[ Parent | on HN ]