News for hackers. Stuff that matters.

A comment on Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide. Parent comment

Re:Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sh... by staticassertion on Monday December 13, 2021 @03:57PM (#29544555)
Does this routing happen before or after log4j would be exploitable? Like if log4j is still running its parser and doing all the crazy stuff, but then routes to some other logger, it doesn't matter.
[ Parent | on HN ]
Re:Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sh... by layer8 on Monday December 13, 2021 @04:03PM (#29544620)
The routing happens before. The vulnerability is due to processing in the log4j back-end, after normal message formatting.
[ Parent | on HN ]
Re:Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sh... by staticassertion on Monday December 13, 2021 @04:08PM (#29544663)
Got it, thanks.
[ Parent | on HN ]