Hacker News new | ask | show | jobs
by dylan604 1655 days ago
nah, it's just a logging package that not everyone uses. it would be much worse if it was in an OS of some sort.
3 comments

Would it? It's a very common logging package, and Java is cross-platform. I also think OSes tend to be updated more often than JDKs (but I'm not sure).
It's used by Elasticsearch, so possible you could exploit the log aggregation service even if the app-level logging library isn't vulnerable, but you'd need a way to make sure the first-level logging doesn't interpret the format string.