#great-lounge Thursday 9 December 202120 messages8 peopleAA Fine Gentleman02:32any plan to add mogus to aether? Ccr24Team02:35in 0.20AAzzyypaarasTeam02:56yeah thisAAzzyypaarasTeam21:29@role uh21:29This is perhaps worryingJJack PapelTeam21:31Man I just installed iris like 30 minutes ago lol21:31Gonna have to reinstall I guessGgudenau21:41Details?PPalgamingHD21:41LolGgudenau21:50https://www.cvedetails.com/cve/CVE-2021-35054/CVE-2021-35054 : Minecraft before 1.17.1, when online-mode=false is...CVE-2021-35054 : Minecraft before 1.17.1, when online-mode=false is configured, allows path traversal for deletion of arbitrary JSON files.21:50Fun.Ggudenau22:16Okay.22:16The vulnerability is stupid and should have never happened.JJack PapelTeam22:21What was it?Ggudenau22:23More or less you could abuse log4j to call thing it shouldn't be able to call.SSollyTeam22:39Can we use this to mod vanilla clients as they join?22:39Ultimate "server side" moddingAAzzyypaarasTeam22:40Nnailuj22:42Replying togudenauMore or less you could abuse log4j to call thing it shouldn't be able to call.How?Ggudenau22:43Feature creep that let you do stupid stuff with {}.
