Re:Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sh...
by isbvhodnvemrwvn on Monday December 13, 2021 @02:55PM
(#29543741)
It's probably worth refining it to `log4j-core`. `log4j-api` or various bridges like `log4j-to-slf4j` are not affected, but will show up in nearly any spring boot app.
[ Parent
| on HN ]
Re:Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sh...
by kerblang on Monday December 13, 2021 @03:03PM
(#29543869)
Just for reference here's the posting that confirms such:
https://spring.io/blog/2021/12/10/log4j2-vulnerability-and-s...
Also worth noting this is not log4j 1, but log4j 2, like angular vs. angularjs. Version 2 is a backwards-incompatible rewrite with a different package structure, effectively a different product. Version 1 is unaffected by this mess.