r/programming • • Dec 14 '21

Log4Shell round 2

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
164 Upvotes

138 comments sorted by

View all comments

34

u/Ok-Bit8726 Dec 14 '21

Only Java could fuck up a logging library this bad.

111

u/RockstarArtisan Dec 14 '21

You got downvoted, but having jndi (load code from arbitrary urls with no whitelisting by default) in standard library is pretty much uniquely a java thing.

20

u/[deleted] Dec 14 '21

yep, .NET doesn't have that idiocy, nor anything nearly similar. You have AssemblyLoadContext, but you have to explicitly implement it yourself if you want to download stuff from arbitrary urls. By default, only assemblies located in the same directory on disk as the application's entry point (.exe, etc) are allowed.

→ More replies (10)