Technical Tag
3 related articles.
Preface A tweet last night attracted considerable attention in the security community. Log4j 2.17.0 has RCE!! Yet the community mostly scoffed: RCE after modifying a configuration file—is that all? So how did configuration-file RCE become fashionable? The story begins…
0x01 Preface While following up on Log4j 2, I found several interesting details and recorded them here. 0x02 Is Log4j Never Vulnerable to JNDI Injection? First, a question: is Log4j never vulnerable to JNDI injection? No. I found an interesting exchange in a Log4j 2 pull request. Someone argued that Log4j is vulnerable…
0x01 Preface. December 9, 2021 became a sleepless night when Apache Log4j was found vulnerable to a simple, high-impact RCE. Countless components depend on Log4j2, apart from the risks in applications themselves. A Maven Repository search for projects using log4j-core 2.14…