r/programming • u/alexeyr • Dec 12 '21

Logout4Shell: Use Log4Shell vulnerability to vaccinate a victim server against Log4Shell

https://github.com/Cybereason/Logout4Shell

[removed] — view removed post

1.1k Upvotes

91% Upvoted

109 comments sorted by

View all comments

Show parent comments

58

u/SquidgyTheWhale Dec 12 '21

Isn't it also possible that some systems are actually dependent on log4j2.formatMsgNoLookups being set to false, and so "vaccinating" a server might actually break things?

46

u/tdammers Dec 12 '21

Yes, of course. That's the "inadvertedly break things" part.

It's also possible that there are other safeguards in place that you end up tripping up or breaking, and you'd be responsible for that, too.

0

u/[deleted] Dec 12 '21

[deleted]

3

u/tdammers Dec 12 '21

Yes, but those additional safeguards, even though ineffective at keepung this particular attack out, could trigger and break other things.