| JP Vossen via plug on 11 Dec 2021 10:18:41 -0800 |
[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]
| Re: [PLUG] Apache Log4j 0-day |
On 12/11/21 10:11 AM, Chad Waters via plug wrote:
On Fri, Dec 10, 2021 at 7:04 PM Keith C. Perry via plug <plug@lists.phillylinux.org <mailto:plug@lists.phillylinux.org>> wrote:
Passing this along since it seems rather serious for those that use this module.
https://www.pcmag.com/news/countless-serves-are-vulnerable-to-apache-log4j-zero-day-exploit <https://www.pcmag.com/news/countless-serves-are-vulnerable-to-apache-log4j-zero-day-exploit>
Of course this happened on my day off. It is in some Ubiquiti stuff. I patched my home UDM yesterday.
This seems like a big one. It's an unauthenticated remote code execution bug in a bunch of Apache products that are used a LOT of places, a lot of which are connected to the internet. There is active scanning for this now. More links: The first one I saw breaking this news: https://www.cyberkendra.com/2021/12/worst-log4j-rce-zeroday-dropped-on.html * https://logging.apache.org/log4j/2.x/security.html * https://www.bleepingcomputer.com/news/security/new-zero-day-exploit-for-log4j-java-library-is-an-enterprise-nightmare/ * https://www.bleepingcomputer.com/news/security/minecraft-rushes-out-patch-for-critical-log4j-vulnerability/ ** The vulnerability is fixed with the release of Minecraft: Java Edition 1.18.1... * https://www.theregister.com/2021/12/10/log4j_remote_code_execution_vuln_patch_issued/ * https://nvd.nist.gov/vuln/detail/CVE-2021-44228 Notes from https://www.bleepingcomputer.com/news/security/minecraft-rushes-out-patch-for-critical-log4j-vulnerability/ * Apache has already released Log4j 2.15.0 to address this maximum severity vulnerability * CVE-2021-44228 can also be mitigated in previous releases (2.10 and later) by setting system property "log4j2.formatMsgNoLookups" to "true" or removing the JndiLookup class from the classpath. Later, JP -- ------------------------------------------------------------------- JP Vossen, CISSP | http://www.jpsdomain.org/ | http://bashcookbook.com/ ___________________________________________________________________________ Philadelphia Linux Users Group -- http://www.phillylinux.org Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce General Discussion -- http://lists.phillylinux.org/mailman/listinfo/plug