Third High Severity CVE in Log4j Is Published

Re:Third High Severity CVE in Log4j Is Published by lazide on Sunday December 19, 2021 @03:56PM (#29618312)

Having been on the receiving end of waiting a long time to get a patch for a actively being exploited zero day - the point is, even if you want to fix it yourself (which I desperately did), you can’t.

If it’s some important piece of software you also can’t stop or the business stops - well, you and everyone else is just going to take it in the pants.

Many enterprises are in exactly this bind. And support contracts only get you so far.

[ Parent | on HN ]

Re:Third High Severity CVE in Log4j Is Published by staticassertion on Sunday December 19, 2021 @06:00PM (#29619448)

I'm losing your point. So, you wanted to patch it, and you couldn't, so how is it bad then that a compiled binary would make patching more difficult?

[ Parent | on HN ]

Re:Third High Severity CVE in Log4j Is Published by lazide on Tuesday December 21, 2021 @12:36AM (#29634303)

It was impossible to fix because it was a compiled binary with no available source. That’s the point.

[ Parent | on HN ]