Re:Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sh...
by ineedasername on Monday December 13, 2021 @03:56PM
(#29544538)
That still seems like an extremely small window of time to remain on the good side of "responsible disclosure" for a vulnerability of this magnitude. The fix was only released 3 days before public disclosure.
[ Parent
| on HN ]
Re:Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sh...
by staticassertion on Monday December 13, 2021 @04:00PM
(#29544580)
Embargoing is very tricky and often harmful. Attackers know how to catch embargo'd vulns, it's often really easy, like in the case of the Linux kernel. If attackers have advanced notice you're only hurting defenders by hiding things from them.
We know that two weeks before disclosure there are attacks using this exploit. Somehow had clearly figured it out, so hiding it was only going to cause problems.