alt Hacker News> It wasn't even a problem with the most popular logging framework at the time.
I can't say if it was most popular overall, but it (Log4Shell) was a nightmare for many F500 companies.
Replies
bunderbunder • today at 1:10 AM
My employer at the time didn’t use log4j, but we were still plenty vulnerable. All sorts of open source packages we used had a transitive dependency on it.
➕ show 1 reply
Was it actually though? I worked at an MSP at the time and our tools were just flagging the mere existence of the library. It either wasn't being used or wasn't exposed in any meaningful way. Oh a dev happens to have it installed on his laptop? Who cares.