Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

techsolvency.com

Post reply on HN
Print view View original

1–10 of 209 posts

Re: Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

#4

Post by benburleson »

winternett wrote: post #3

Clone Git Repo... CTRL+F "log4j"... 0 results... (sigh of relief)... :|

"A project with a footprint like Log4j is not possible to avoid as a transient dependency even if you don’t directly import it. Log4j is a canonical logging utility for a huge ecosystem. Its current radius is beyond doing due diligence." - @rakyll (AWS)

Re: Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

#5

Post by mateuszf »

benburleson wrote: post #4
winternett wrote: post #3

Clone Git Repo... CTRL+F "log4j"... 0 results... (sigh of relief)... :|

"A project with a footprint like Log4j is not possible to avoid as a transient dependency even if you don’t directly import it. Log4j is a canonical logging utility for a huge ecosystem. Its current radius is beyond doing due diligence." - @rakyll (AWS)

Yeah - for example to determine if log4j is used in a maven project one would have to run "mvn dependency:tree | grep log4j".

Which I did today for our 60 microservices.

And also for projects deployed as war files - container server libraries also have to be checked.

Re: Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

#6

Post by bob1029 »

winternett wrote: post #3

Clone Git Repo... CTRL+F "log4j"... 0 results... (sigh of relief)... :|

We are a .NET shop and we are having to review some things regardless of not having any direct references to log4j or even any java source code.

Lots of developer tools happen to use Java - one immediate example we are investigating is Jenkins.

Re: Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

#7

Post by blibble »

mateuszf wrote: post #5
benburleson wrote: post #4

Earlier quoted context omitted.

"A project with a footprint like Log4j is not possible to avoid as a transient dependency even if you don’t directly import it. Log4j is a canonical logging utility for a huge ecosystem. Its current radius is beyond doing due diligence." - @rakyll (AWS)

Yeah - for example to determine if log4j is used in a maven project one would have to run "mvn dependency:tree | grep log4j". Which I did today for our 60 microservices. And also for projects deployed as war files - container server libraries also have to be checked.

you better hope one of your dependencies hasn't vendored it!

Re: Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

#8

Post by Macha »

jcadam wrote: post #2

Generally, when the boss asks you which logging library your Javaland project uses, the answer is "all of them."

Discovered one legacy project which did jboss logging -> log4j-over-slf4j -> slf4j -> logback

For what the project used it for, jboss logging could have been replaced with direct slf4j usage, and even if it hadn't, supports slf4j directly so that was a headscratcher

Re: Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

#9

Post by winternett »

benburleson wrote: post #4
winternett wrote: post #3

Clone Git Repo... CTRL+F "log4j"... 0 results... (sigh of relief)... :|

"A project with a footprint like Log4j is not possible to avoid as a transient dependency even if you don’t directly import it. Log4j is a canonical logging utility for a huge ecosystem. Its current radius is beyond doing due diligence." - @rakyll (AWS)

I understand... The main point I'm addressing is whether an immediate A.O.R. will be in the line of "blowback", "compromise", and/or "fallout" with that statement.

It's fun to stay at the C.Y.A. :P

Post reply on HN