On December 9th, it was made public on Twitter that a zero-day exploit had been discovered in log4j, a popular Java logging library. All the library’s versions between 2.0 and 2.14.1 included are affected. Log4j 2.15.0 has been released, which no longer has this vulnerability. As the POC published on GitHub points out, when log4j logs an attacker-controlled string value it can result in a RCE. By Olimpiu Pop
On December 9th, it was made public on Twitter that a zero-day exploit had been discovered in log4j, a popular Java logging library. All the library’s versions between 2.0 and 2.14.1 included are affected. Log4j 2.15.0 has been released, which no longer has this vulnerability. As the POC published on GitHub points out, when log4j logs an attacker-controlled string value it can result in a RCE.
By Olimpiu PopRead More
