Log4j 2.15.0 – Previously suggested mitigations may not be enough

Re:Log4j 2.15.0 – Previously suggested mitigations may not b... by xorcist on Thursday December 16, 2021 @07:19AM (#29577445)

My initial reaction was also tentative skepticism. Not that the package isn't popular, but that it must be hard to find real world interactions where you can successfully get a payload in, and a lot fewer still where you can actually execute it.

Yet we have seen a large number of high profile hacks already, and they keep coming. Turns out that not only are there many ancient java versions in use, the aren't very compartmentalized either.

[ Parent | on HN ]

Re:Log4j 2.15.0 – Previously suggested mitigations may not b... by twic on Thursday December 16, 2021 @09:09AM (#29578237)

Is there a list of successful hacks anywhere? Most of what i've seen on Twitter is someone posting an attack string to a website, then showing a record of a DNS lookup, which is some distance from actually being a successful exploit.

[ Parent | on HN ]