log4j - vulnerability - Strikes !
Apache Log4j

log4j - vulnerability - Strikes !

Aswin RAM Aswin RAM

Aswin RAM

发布日期: 2021年12月11日
+ 关注
Log4j zero-day vulnerability discovered, affects iCloud, Minecraft, Steam, and more services.

A newly discovered zero-day vulnerability in the widely used Java logging library Apache Log4j is easy to exploit and enables attackers to gain full control of affected servers.

What is log4j ? log4j is a reliable, fast and flexible logging framework (APIs) written in Java, which is distributed under the Apache Software License. log4j is a popular logging package written in Java. log4j has been ported to the C, C++, C#, Perl, Python, Ruby, and Eiffel languages.

How to find if your application has a threat for this ? To check whether your application is likely affected you must verify: Log4j version – all 2.x versions before 2.15.0 (released today, Friday, December 10, 2021) are affected

  • JVM version - if lower than:
  • Java 6 – 6u212
  • Java 7 – 7u202
  • Java 8 – 8u192
  • Java 11 - 11.0.2

If both are true, your Log4j version is older than 2.15.0 and your Java version patch level is older than listed above, you’re almost certainly affected

What is the solution ?

Using Java 1.8 or higher? Download the latest Log4j mitigated version 2.15.0 from its download page.

If you can’t upgrade immediately and are using Java 8u121 or later. If the Java version is >= 8u121 it is possible to mitigate the issue by setting,

com.sun.jndi.rmi.object.trustURLCodebase to false and com.sun.jndi.cosnaming.object.trustURLCodebase to false. It’s still preferable to update log4j version to secure one as soon as possible.

领英推荐

Using Java version less than 1.8 Source: https://logging.apache.org/log4j/2.x/security.html

In earlier versions of log4j >= 2.10 it is possible to mitigate this issue by Setting the system property

formatMsgNoLookups: true Or

Set the JVM parameter

-Dlog4j2.formatMsgNoLookups=true Or

Removing JndiLookup class from the classpath

example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.clas

Hope this might help to reduce the vulnerability across your applications which uses log4j.

Source Credits: Veracode , India Today

要查看或添加评论，请登录

Aswin RAM的更多文章

  • November Challenge
    2024年11月1日

    November Challenge

    As November kicks in, it's the perfect time to set new intentions and take on a challenge that nourishes the mind…

    1 条评论
  • The Leadership Mindset
    2024年5月11日

    The Leadership Mindset

    Discussion from: Coffee Connect with Aswin RAM #episode 68 Background: Coffee Connect is a casual conversation…

    1 条评论
  • <BIG DATA>
    2023年5月11日

    <BIG DATA>

    What is Big DATA? A massive amount of data which is difficult to manage / analyze because of its volume and complexity…

    3 条评论
  • <ADAS>
    2023年4月11日

    <ADAS>

    ADAS : Advanced Driver Assistance Systems ADAS - an electronic system in a vehicle that use advanced technologies such…

  • <Cloud>
    2022年12月15日

    <Cloud>

    What is Cloud computing? Imagine a virtual place, which helps you to deliver all your computing services (servers…

  • Jenkins
    2022年12月8日

    Jenkins

    What is Jenkins? Jenkins is a self-contained Java program, open-source automation server which can be used to automate…

    4 条评论
  • <Agile>
    2022年8月15日

    <Agile>

    What is Agile? In a software development cycle, companies usually follow some pre defined methodologies to get faster…

  • Code AS Documentation
    2022年6月4日

    Code AS Documentation

    Code Documentation !? Ever thought of a scenario where a piece of code/API written by you a long time ago seems to be…

  • DevOps
    2022年4月28日

    DevOps

    What is DevOps ? DevOps is a culture wherein the Operations team combine to work directly with the developing team to…

    4 条评论
  • JavaScript - JSON
    2022年2月10日

    JavaScript - JSON

    What is JSON ? JavaScript Object Notation - is language independent, lightweight, data interchange format. It is a…

    2 条评论

社区洞察

其他会员也浏览了