Log4j exploits (not 44228)

[Arkyo]

 

 am sure most of us have heard of the 44228 exploit that was discovered like a week ago, and I know that Mojang & Forge have released fixes respectively.

HOWEVER there are even more log4j exploits:  https://imgur.com/M6E9If6 CVE 45046 and 45105

I wonder if anyone knows whether Mojang/Forge acknowledge these? 

 

On top of that, Forge 37.1.1&36.2.20 fixed 44228, but they are still using Log4j 2.15, which means they are still affected by these 2 new exploits right?

 

Edited December 19, 2021 by Arkyo

[Wolf1098]

then why is this being published? Minecraft rushes out patch for critical Log4j vulnerability (bleepingcomputer.com) https://www.bleepingcomputer.com/news/security/minecraft-rushes-out-patch-for-critical-log4j-vulnerability/