Security Countless Servers Are Vulnerable to Apache Log4j Zero-Day Exploit (Log4Shell)

Jimmy · Dec 24, 2021

eva2000 said: ↑

Definitely, a long way to go still!
Click to expand...

Yup.

eva2000 · Dec 24, 2021

Well Crowdsec has been busy https://crowdsec.net/log4j-tracker/

This report includes real-time data reported by the CrowdSec Community. IPs originating from known public scanners are discarded from this report (mostly IPs from Germany) but are included in our full IP list available in this Gist.
Click to expand...

Jimmy · Dec 28, 2021

eva2000 said: ↑

Well Crowdsec has been busy https://crowdsec.net/log4j-tracker/
Click to expand...

Interesting data.

eva2000 · Dec 31, 2021

Another log4j vulnerability was discovered (CVE-2021-44832) so v2.17.0 is not longer secure. Folks need to update to log4j v2.17.1 so Elasticsearch search may need another update?

https://logging.apache.org/log4j/2.x/

Log4j 2.17.1has been released to:

Address CVE-2021-44832.

Other minor bug fixes.

2.17.1 (for Java 8) is a recommended upgrade.

Log4j 2.17.1 is now available for production. The API for Log4j 2 is not compatible with Log4j 1.x, however an adapter is available to allow applications to continue to use the Log4j 1.x API. Adapters are also available for Apache Commons Logging, SLF4J, and java.util.logging.

Log4j 2.17.1 is the latest release of Log4j. As of Log4j 2.13.0 Log4j 2 requires Java 8 or greater at runtime. This release contains new features and fixes which can be found in the latest changes report.

Log4j 2.17.1 maintains binary compatibility with previous releases.
Click to expand...

https://nvd.nist.gov/vuln/detail/CVE-2021-44832

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
Click to expand...

Jimmy · Jan 1, 2022

Jimmy said:

eva2000 said: ↑

Definitely, a long way to go still!
Click to expand...

Yup.
Click to expand...

The Neverending Story III

Jimmy · Apr 30, 2022

I just read yesterday that there is still huge problems.... holes... etc. [see image above]

eva2000 · Apr 30, 2022

Jimmy said: ↑

I just read yesterday that there is still huge problems.... holes... etc. [see image above]
Click to expand...

In log4j itself or in 3rd party software that embed older log4j related vulnerable versions?

Log in / Register

Forums

Join the community today

Security Countless Servers Are Vulnerable to Apache Log4j Zero-Day Exploit (Log4Shell)

Jimmy Well-Known Member

eva2000 Administrator Staff Member

Jimmy Well-Known Member

eva2000 Administrator Staff Member

Jimmy Well-Known Member

Jimmy Well-Known Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Join the community today

Security Countless Servers Are Vulnerable to Apache Log4j Zero-Day Exploit (Log4Shell)

Jimmy Well-Known Member

eva2000 Administrator Staff Member

Jimmy Well-Known Member

eva2000 Administrator Staff Member

Jimmy Well-Known Member

Jimmy Well-Known Member

eva2000 Administrator Staff Member

.