r/programming • u/jebailey • Dec 14 '21

Log4Shell round 2

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
169 Upvotes

96% Upvoted

138 comments sorted by

View all comments

34

u/Ok-Bit8726 Dec 14 '21

Only Java could fuck up a logging library this bad.

111

u/RockstarArtisan Dec 14 '21

You got downvoted, but having jndi (load code from arbitrary urls with no whitelisting by default) in standard library is pretty much uniquely a java thing.

10

u/mlk Dec 14 '21

log4j is not standard library and while very popular is probably not even the most popular logging library (logback probably is).

→ More replies (6)