Bryan retweeted
@bryans3c and I reproduced apache/logging-log4j2 #4255 on official Log4j 2.26.1. It is not Log4Shell.
In our lab, command execution needed a Java-serialized LogEvent receiver and a gadget library already on the JVM. log4j-api and log4j-core were not enough.
Brief generated overview:
A new Log4j2 vulnerability storm is brewing.Log4j2 FilteredObjectInputStream Bypass Vulnerability .This is a critical remote code execution (RCE) vulnerability affecting Log4j versions 2.11.0 through 2.26.1.#Log4j2
github.com/apache/logging-lo…
