Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by imglorp | Hacker News Reader

Parent Full thread

imglorp·

There's a new CVE filed for it, just now. And here are the others for reference.

12/18 - https://nvd.nist.gov/vuln/detail/CVE-2021-45105 Score: -

12/14 - https://nvd.nist.gov/vuln/detail/CVE-2021-45046 Score: 3.7

12/14 - https://nvd.nist.gov/vuln/detail/CVE-2021-4104 Score: 8.1

12/10 - https://nvd.nist.gov/vuln/detail/CVE-2021-44228 Score: 10.0

View on HN

CVE page for 45046 says that the score is being revised. Log4j self-assesses 9.0/10 as the new score: https://logging.apache.org/log4j/2.x/security.html (see under Fixed in Log4j 2.12.2 (Java 7) and Log4j 2.16.0 (Java 8)).

And the new CVE-2021-45105 is self-assessed to have a CVSS of 7.5/10 (see the same page above).

What surprises me is the scoring... for a non-default config. Seems a little high, but these seem inflated, maybe just because of the attention.

Particularly with the `${ctx:...}` vs `%X{...}` distinction. For a plain DoS, which only affects `${ctx:...}` usage? I wouldn't panic, fix it if someone manages to actually exploit it...

It's goods new so far that with more people/time and attention paid to the log4j exloits, the vulnerabilities are just getting narrower in scope and lesser in impact.

I think the scoring is done from the assumption that many users may be concatenating a log string instead of formatting it. If you format your log strings, 7.5 is definitely too high.

The scoring has little merit in general.

Reply on news.ycombinator.com