Hacker News new | ask | show | jobs
by IiydAbITMvJkqKf 1655 days ago
I think the "generous" perspective is that there was a JRE update once which disabled the remote code execution feature by default. Note, this was a JRE update, not a log4j update.
1 comments

Note, as others have commented, the JRE change prevented the fully open-ended RCE where you could download classfiles from an external server and run them. However, the log4j bug does still allow posting of environment variables to external servers, even with the JRE changes, which could be just as catastrophic.

That was my understanding anyway, someone correct me if I'm wrong.