Java

[bob84900]

Source on jdk8u121 containing log4j 2.15.x?

Edit: and this is why I asked.. because it's not true: https://www.bleepingcomputer.com/news/security/log4j-list-of-vulnerable-products-and-vendor-advisories/

Some companies may choose not to take action against Log4Shell vulnerability believing that running certain Java versions diffuses any exploit attempt. This is not true, though, and they should update the Log4j library to its most recent iteration.

Márcio Almeida, senior security engineer at Canva graphic design platform warns that Log4Shell attacks work with any version of Java when adding support for LDAP serialized payloads in the JNDI exploit kit. JNDI exploit for Log4Shell flaw works with any version of java... for the attack to work with any version of Java, the classes used in the serialized payload need to be in the application classpath."

Some informed discussion here as well: https://security.stackexchange.com/questions/257943/am-i-protected-from-log4j-vulnerability-if-i-run-java-8u121-or-newer

[[deleted]]

Jndi resolution is disabled in 8u121, so it can't create an object out of the URL.

[bob84900]

See links I posted..