News for hackers. Stuff that matters.
Re:Third High Severity CVE in Log4j Is Published by junon on Sunday December 19, 2021 @06:27AM (#29613113)
You don't need to, you're right. But people aren't going to be writing very complex mitigations by reverse engineering the bytecode generated by a compiler, especially for OSS. There are many compilers, many optimizations, and some of them can even produce non-deterministic outputs (not common but it can happen). The amount of patching for an internal subroutine, which is probably what would have resulted here, would have been completely practically infeasible.

There are no comments on this comment yet.