Re:Third High Severity CVE in Log4j Is Published
by junon on Sunday December 19, 2021 @06:27AM
(#29613113)
You don't need to, you're right. But people aren't going to be writing very complex mitigations by reverse engineering the bytecode generated by a compiler, especially for OSS. There are many compilers, many optimizations, and some of them can even produce non-deterministic outputs (not common but it can happen). The amount of patching for an internal subroutine, which is probably what would have resulted here, would have been completely practically infeasible.
[ Parent
| on HN ]
There are no comments on this comment yet.