Timeline for Is log4j-over-slf4j vulnerable to log4shell?
Current License: CC BY-SA 4.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 24, 2022 at 19:38 | comment | added | mentallurg | @VicSeedoubleyew: I have updated the answer. | |
| Jan 24, 2022 at 19:37 | history | edited | mentallurg | CC BY-SA 4.0 |
added 651 characters in body
|
| Jan 24, 2022 at 16:08 | comment | added | Vic Seedoubleyew | If you care to add this more clearly to your answer, and potentially provide a reference to support this claim, I could mark this as a valid answer | |
| Jan 19, 2022 at 13:10 | comment | added | mentallurg | @VicSeedoubleyew: No. This library does not contain the buggy class. | |
| Jan 19, 2022 at 11:39 | comment | added | Vic Seedoubleyew |
My question is not whether having log4j-over-slf4j guarantees that there is nothing else. My question is whether that particular library is vulnerable, and how to interpret SLF4J's mention of the "underlying implementation"
|
|
| Jan 18, 2022 at 15:56 | comment | added | mentallurg |
@VicSeedoubleyew: If there is only log4j-over-slf4j, this means usually that there is some implementation of SLF4J. For instance, if you have a Spring Boot application and use Logback by default. But this does not guarantee that the JndiLookup.class is not present in some of your dependencies. Only if you know how the application was built, if you see in the Maven or Gradle configuration only standard dependencies and if you know that only trusted repositories were used like Maven Central, then the probability that the buggy class is present is low.
|
|
| Jan 18, 2022 at 9:42 | comment | added | Vic Seedoubleyew |
Also, to your question Who else can know it, if not you? You do logging in your application, so you know what logging implementation you use., the fundamental reason why this log4shell vulnerability is a problem for the world, is that it's not just about the direct logging that each developer does. It's about dependencies including dependencies recursively, and some down the road that adds log4j. A very basic search about log4shell answers your reaction, that no, it is not easy to know whether there is log4j used on a particular system
|
|
| Jan 18, 2022 at 9:40 | comment | added | Vic Seedoubleyew | Thanks for the answer. Unfortunately I feel like I have included more details in my answer than you have accounted for. I specifically mentioned that there is no other file containing "log4j" in its name on my system. | |
| Jan 18, 2022 at 3:53 | history | edited | mentallurg | CC BY-SA 4.0 |
added 1 character in body
|
| Jan 17, 2022 at 21:41 | history | answered | mentallurg | CC BY-SA 4.0 |