<story><title>New Log4j2 vulnerability</title><url>https://nvd.nist.gov/vuln/detail/CVE-2021-44832</url></story><parent_chain></parent_chain><comment><author>oars</author><text>Please update the title to indicate this is a low severity CVE and prevent managers around the world from panicking and summoning their developers and engineers  back at work during this shut down period.&lt;p&gt;To be honest, I panicked reading this title when I opened HN this evening, but reading the CVE entry tells me this isn&amp;#x27;t anywhere close to as serious as CVE-44228.&lt;p&gt;You have a responsibility to not just share information on HN, but to share it in an accurate and well thought manner.</text></comment>
<story><title>New Log4j2 vulnerability</title><url>https://nvd.nist.gov/vuln/detail/CVE-2021-44832</url></story><parent_chain></parent_chain><comment><author>rst</author><text>The threat here is that &amp;quot;an attacker with permission to modify the logging configuration file can construct a malicious configuration&amp;quot;.  If the attacker can modify server config files, this particular log4j fixup is likely to still leave you with nasty problems.</text></comment>