21–30 of 209 posts
What about desktop application vulnerabilities? There are quite a few applications built with java, which include log4j.
JetBrains IDEs are probably affected.
Clone Git Repo... CTRL+F "log4j"... 0 results... (sigh of relief)... :|
"A project with a footprint like Log4j is not possible to avoid as a transient dependency even if you don’t directly import it. Log4j is a canonical logging utility for a huge ecosystem. Its current radius is beyond doing due diligence." - @rakyll (AWS)
Clone Git Repo... CTRL+F "log4j"... 0 results... (sigh of relief)... :|
We are a .NET shop and we are having to review some things regardless of not having any direct references to log4j or even any java source code. Lots of developer tools happen to use Java - one immediate example we are investigating is Jenkins.
See https://www.jenkins.io/blog/2021/12/10/log4j2-rce-CVE-2021-4...
But it’s often still possible to use a different backend, via the Log4j to SLF4J adapter: https://logging.apache.org/log4j/2.x/log4j-to-slf4j/
Earlier quoted context omitted.
"A project with a footprint like Log4j is not possible to avoid as a transient dependency even if you don’t directly import it. Log4j is a canonical logging utility for a huge ecosystem. Its current radius is beyond doing due diligence." - @rakyll (AWS)
Can you parse this quote for me? I do not understand it.
Earlier quoted context omitted.
"A project with a footprint like Log4j is not possible to avoid as a transient dependency even if you don’t directly import it. Log4j is a canonical logging utility for a huge ecosystem. Its current radius is beyond doing due diligence." - @rakyll (AWS)
Can you parse this quote for me? I do not understand it.
Earlier quoted context omitted.
We are a .NET shop and we are having to review some things regardless of not having any direct references to log4j or even any java source code. Lots of developer tools happen to use Java - one immediate example we are investigating is Jenkins.
FWIW, Jenkins does not use Log4j. Some plugins may, and there's a quick way to determine if it does. Go to the script console, enter in "org.apache.logging.log4j.core.lookup.JndiLookup.class.protectionDomain.codeSource" (without the quotes) and if it returns "groovy.lang.MissingPropertyException: No such property: org for class: Script1" then you are not affected. See https://www.jenkins.io/blog/2021/12/10/log4j2-rce…
What about desktop application vulnerabilities? There are quite a few applications built with java, which include log4j.
Earlier quoted context omitted.
"A project with a footprint like Log4j is not possible to avoid as a transient dependency even if you don’t directly import it. Log4j is a canonical logging utility for a huge ecosystem. Its current radius is beyond doing due diligence." - @rakyll (AWS)
Yeah - for example to determine if log4j is used in a maven project one would have to run "mvn dependency:tree | grep log4j". Which I did today for our 60 microservices. And also for projects deployed as war files - container server libraries also have to be checked.
This article[1] probably seems like a bit of convenient self-promotion from Anchore - but the two tools grype and syft
https://github.com/anchore/grype
https://github.com/anchore/syft
Turned out to be very helpful in easily looking through folders, installed services (in particular an installed mobile device manager running on windows) and container images.
[1] https://www.infoworld.com/article/3644492/how-to-detect-the-...
Submitted to hn as: https://news.ycombinator.com/item?id=29543589 in case there's more discussion of tooling that might fit there.