More Info on log4j zero day vulnerability

The mails below were posted to the jug-leaders and  javachampions list yesterday and today for general Java usage of log4j. 


                                                    Joe Sam

Joe Sam Shirah -        www.conceptgo.com  (904) 302-6870
conceptGO       -         Consulting/Development/Outsourcing
Java Filter Forum:       www.ibm.com/developerworks/java
Just the JDBC FAQs:  www.jguru.com/faq/JDBC
Going International?   www.jguru.com/faq/I18N
Que Java400?            www.jguru.com/faq/Java400


-------------------------------------------------------------------------------------------------------------------------


olimpiu pop olimpiu.pop@xxxxxxxxx via groups.io
    
   
to jug-leaders, javachampions
On the same topic:

https://www.infoq.com/news/2021/12/log4j-zero-day-vulnerability/

We tried to add all relevant content.



On Mon, 13 Dec 2021 at 15:33, Bruno Bossola <bbossola@xxxxxxxxx> wrote:

    Hi all,

    Please make sure that this is known across your JUGs / companies and the information is passed around properly. A new zero-day has been discovered in Apache Log4j, is actively exploited in the wild, and looks awful. It will be filed as CVE-2021-44228, see our blog post if you want more info, I will drop some info here.

    The problem:
    This vulnerability allows the attacker to remotely execute code on your system, with the ability to get complete control of the underlying servers.

    Mitigations:
    Upgrade all instances of log4j-core to version 2.15:
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-core</artifactId>
            <version>2.15</version>
        </dependency>



    Alternatively, launch the JVM with this parameter:
    -Dlog4j2.formatMsgNoLookups=true
    (useful for example for Jenkins or similar installations where you do not control the code directly)

    Some people also suggest patching the library class directly but I would not do that.

    Conclusions:
    As you may have hinted, this is big. Apache Log4j is used by A LOT of libraries and frameworks themselves, so please make sure you are safe.

    Cheers,

        Bruno

    p.s.
    The latest version of Apache Struts, 2.5.28, uses by default Log4j 2.12.21 (vulnerable), so the story may repeat itself ;)


    --
    Bruno Bossola
    CTO - meterian.io
    Scan your website now!
    Scan your project now!