Re:Log4j 2.15.0 – Previously suggested mitigations may not b...
by wing-_-nuts on Thursday December 16, 2021 @10:42AM
(#29579298)
You're now making me feel better about our decision to exclude the log4j-api from our spring build entirely.
[ Parent
| on HN ]
Re:Log4j 2.15.0 – Previously suggested mitigations may not b...
by freeqaz on Thursday December 16, 2021 @11:45AM
(#29580223)
log4j-api isn't actually a problem (directly). It's the usage of log4j-core that has the JndiManager class that's the injection point for RCE.
In the case of the transient dependency, it's further complicated because we've seen that some packages repackage the JARs they depend on... that means that statically analyzing for log4j is very difficult because you can't use hashes (even if you unzip the jar and hash class files directly).
I've been working on a scanner for this stuff on GitHub[0], and it's a real pain in the neck lol. Especially for Vendor software that you don't control.
0: https://github.com/lunasec-io/lunasec/tree/master/tools/log4...