Log4j: Between a rock and a hard place
I get that this is a big deal (any remote code execution that is prevalent is a big deal).But one thing that I haven't seen mentioned enough is that this only affects pretty old versions of java.From https://www.veracode.com/blog/security-news/urgent-analysis-...    JVM version - if lower than:
        Java 6 – 6u212 (java6 first released in 2006, this version appears unreleased?)
        Java 7 – 7u202 (java7 first released in 2011 this version appears unreleased?)
        Java 8 – 8u192 (from 2018)
        Java 11 - 11.0.2 (from 2019)

The current version of java is java17. Anything running on 17 or 14 (the last major release) isn't vulnerable.Now, I get that major version upgrades are a hassle, but I haven't seen anyone address the "hey, you should have upgraded" elephant in the room.(All java release dates from https://www.java.com/releases/ )