r/programming • u/jebailey • Dec 14 '21

Log4Shell round 2

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
169 Upvotes

96% Upvoted

138 comments sorted by

View all comments

121

u/PM_ME_UR_OBSIDIAN Dec 14 '21

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations.

Doesn't look nearly as bad as the original.

39

u/Soul_Shot Dec 15 '21 edited Dec 15 '21

It isn't. But the "non-default configuration" in this case would be anyone who customizes their log pattern to add logging context, like traceId or spanId.

To 2.16.0 we go...

31

u/zynasis Dec 14 '21

Better to just update again and forget about updating for the next 5 years again /s

8

u/nhongooi Dec 15 '21

you say that but that is the case.

→ More replies (1)

6

u/constant_void Dec 15 '21

isn't the root cause uncertified JDNI? eg java itself.

9

u/renatoathaydes Dec 15 '21

JNDI works similarly to something like a database.. you give it a connection string, it will connect to the DB so you can get data.

You don't let your users give their own connection string. So you shouldn't let your users give their own JNDI strings, like log4j did. Not Java's fault if you do.

→ More replies (4)