Synopsys SIGThe lax handling of security

In mid-December 2021, the "Log4Shell" vulnerability was discovered in the Java library Log4j. An incident that gnaws at the image of open source. How is damage limitation possible when using open source?