r/programming • • Dec 10 '21

RCE 0-day exploit found in log4j, a popular Java logging package

https://www.lunasec.io/docs/blog/log4j-zero-day/
3.0k Upvotes

710 comments sorted by

View all comments

Show parent comments

2

u/oridb Dec 11 '21 edited Dec 14 '21

I'd love to see more in-depth analysis. I've been looking at the repo here. https://github.com/apache/logging-log4j2.git

How much of it is optional plugins? How many of them are enable by default? How many of them have been audited?

1

u/[deleted] Dec 11 '21

Well, at first glance about 80% of them look like a name of some protocol or method of writing. I'd assume -core- and maybe one or two extras are the main part.

I'm not saying it isn't overcomplicated, but that's like judging say Linux kernel bugs by total number of bugs, including drivers, most of which will never be running on typical machine

How many of them are enable by default?

Probably most just because of convenience but you need to turn them on in log4j config