log4j CVE-2021-44228

[Big_Bend]

Holy cow! I've been in corporate IT for 35 years and I've never seen anything like this.



log4j is a java library, and this flaw is allowing every hacker wannabe to easily hack into over 3 billion devices. Huge level 10 zero day exploit.

I work for an investment firm, its all chaos, massive all hands on deck as we research the progress of patches needed to secure our systems.

Funny this all started with Mindcraft, now its everywhere.

Anyone else dealing with this...

This is going to be really bad.

 

[Bruxist]

Yeah. This is a bad one. And I thought wannacry was a pain.

 

[aging_rocker]

Yeah, it's been keeping me busy for the last few days. Potentially devastating for some.

Luckily, we (govt department) don't seem to have much vulnerability to this, but explaining all that to (some) managers can be a challenge...

 

[dankilling]

Funny that Mojang issued a patch in hours and we are still waiting for one from the big players in the IT market space

 

[glenlivet]

....it's ALWAYS Java, always.
Oh well....job security.

 

[glenlivet]

..hope you didn't patch to soon.

The description of the new vulnerability, CVE 2021-45046, says the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was "incomplete in certain non-default configurations."

 

[Blrfl]

I got to write the "not vulnerable in the configuration we ship" email to the users.

 

[surf_jimi]

I’m patching our servers as we speak.

 

[ghostchord]

Yeah some headaches over here as well. I don't think this is the worst one I've seen by any means. There have been a few over the years. To exploit it you do need to be able to inject specific text into the logger. This is only log4j2 there's plenty of unaffected log4j1 around. But yeah, it's not fun. The more scary thing is there's probably an infinite number of similar issues we just don't know about.

 

[BigDaddyLH]

Now I don't so bad about never writing logging statements.

 

[6stringcowboy]

We were seeing it from the usual suspects within 4 hours of its announcement.

 

[HoodieMcFoodie]