Log4j: Between a rock and a hard place
I get that this is a big deal (any remote code execution that is prevalent is a big deal).<p>But one thing that I haven't seen mentioned enough is that this only affects pretty old versions of java.<p>From <a href="https://www.veracode.com/blog/security-news/urgent-analysis-and-remediation-guidance-log4j-zero-day-rce-cve-2021-44228" rel="nofollow">https://www.veracode.com/blog/security-news/urgent-analysis-...</a><p><pre><code>    JVM version - if lower than:
        Java 6 – 6u212 (java6 first released in 2006, this version appears unreleased?)
        Java 7 – 7u202 (java7 first released in 2011 this version appears unreleased?)
        Java 8 – 8u192 (from 2018)
        Java 11 - 11.0.2 (from 2019)
</code></pre>
The current version of java is java17. Anything running on 17 or 14 (the last major release) isn't vulnerable.<p>Now, I get that major version upgrades are a hassle, but I haven't seen anyone address the "hey, you should have upgraded" elephant in the room.<p>(All java release dates from <a href="https://www.java.com/releases/" rel="nofollow">https://www.java.com/releases/</a> )