News for hackers. Stuff that matters.

A comment on Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide. Parent comment

Re:Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sh... by vips7L on Monday December 13, 2021 @02:33PM (#29543432)
Really should run `mvn dependency:tree | grep log4j`
[ Parent | on HN ]
Re:Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sh... by shartte on Monday December 13, 2021 @03:23PM (#29544127)
You can disregard a combination of log4j-api+log4j-over-slf4j (as is used by default by Spring Boot) since the actual vulnerability is not in the Log4j2 API, but rather in the actual logging implementation. So forwarding of the Log4j2 API via slf4j to logback is unaffected.
[ Parent | on HN ]
Re:Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sh... by krzyk on Monday December 13, 2021 @02:56PM (#29543762)
Some libs might shade log4j. You need to look for JndiLookup.class in all jars.
[ Parent | on HN ]
Re:Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sh... by zorr on Monday December 13, 2021 @04:42PM (#29545057)
and if it's a gradle project `gradle -q dependencies | grep log4j`.
[ Parent | on HN ]