Third High Severity CVE in Log4j Is Published

Re:Third High Severity CVE in Log4j Is Published by klyrs on Saturday December 18, 2021 @03:58PM (#29608436)

I'd agree if this was the first CVE. But that got some attention to log4j, which quickly exposed two more CVEs. There's no such thing as perfect, but these problems almost certainly would have been caught by a competent security audit.

[ Parent | on HN ]

Re:Third High Severity CVE in Log4j Is Published by TedDoesntTalk on Saturday December 18, 2021 @04:25PM (#29608669)

Has any of your software been through a security audit? Mine has. It’s 99.9% OWASP coverage with some automated fuzzing with almost no imagination applied by the auditors. You’re assigning far too much ability to auditors.

[ Parent | on HN ]

Re:Third High Severity CVE in Log4j Is Published by klyrs on Saturday December 18, 2021 @04:33PM (#29608738)

Upthread, I mentioned that I've been party to it three times. And yes, auditor skill and methods vary.

[ Parent | on HN ]