Re:Third High Severity CVE in Log4j Is Published
by Macha on Sunday December 19, 2021 @06:26AM
(#29613108)
> If you think Log4j is bad, wait until Rust gets popular and has something similar happens with a commonly used crate. How would you scan for a vulnerability in compiled code that doesn't even have separate module files?
Our software scans take 3 forms:
1. Searching for file names
2. Running test exploits that have a payload that just logs the vulnerability with a central monitoring system
3. Dependency resolution and checks against a DB (our solution _already_ supports Cargo.lock files.
Rust (and Go, C++, etc.) only prevent option 1. Thanks to bundlers it also can miss it in JS, or shaded fatjars it can also fail kn Java too. So it's not a new challenge
Our software scans take 3 forms:
1. Searching for file names
2. Running test exploits that have a payload that just logs the vulnerability with a central monitoring system
3. Dependency resolution and checks against a DB (our solution _already_ supports Cargo.lock files.
Rust (and Go, C++, etc.) only prevent option 1. Thanks to bundlers it also can miss it in JS, or shaded fatjars it can also fail kn Java too. So it's not a new challenge