tchart Well-Known Member Licensed User Longtime User Dec 10, 2021 #1 In case anyone is using log4j you should upgrade ASAP Log4j RCE 0-day actively exploited | CERT NZ An unauthenticated RCE vulnerability in the commonly used Log4j java library is being actively exploited. www.cert.govt.nz
In case anyone is using log4j you should upgrade ASAP Log4j RCE 0-day actively exploited | CERT NZ An unauthenticated RCE vulnerability in the commonly used Log4j java library is being actively exploited. www.cert.govt.nz
EnriqueGonzalez Expert Licensed User Longtime User Dec 10, 2021 #2 It is indeed ubiquitous that library Upvote 0
avalle Active Member Licensed User Longtime User Dec 10, 2021 #3 More info here: https://nvd.nist.gov/vuln/detail/CVE-2021-44228 and here: https://logging.apache.org/log4j/2.x/security.html An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. Click to expand... Upvote 0
More info here: https://nvd.nist.gov/vuln/detail/CVE-2021-44228 and here: https://logging.apache.org/log4j/2.x/security.html An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. Click to expand...
avalle Active Member Licensed User Longtime User Dec 13, 2021 #5 jServer is based on Jetty. It provides logging via its own org.eclipse.jetty.util.log.Logger layer, and does not natively use any existing Java logging framework. See https://docs.huihoo.com/jetty/the-definitive-reference/configuring-logging.html Upvote 0
jServer is based on Jetty. It provides logging via its own org.eclipse.jetty.util.log.Logger layer, and does not natively use any existing Java logging framework. See https://docs.huihoo.com/jetty/the-definitive-reference/configuring-logging.html
b4x-de Active Member Licensed User Longtime User Dec 13, 2021 #6 I'm glad about this. Thanks. I was asking because B4JServer uses mchange-commons and it contains Log4J classes in com.mchange.v2.log Upvote 0
I'm glad about this. Thanks. I was asking because B4JServer uses mchange-commons and it contains Log4J classes in com.mchange.v2.log
C Chris2 Well-Known Member Licensed User Longtime User Dec 14, 2021 #7 It's been deemed serious enough to warrant a BBC article as well - https://www.bbc.co.uk/news/technology-59638308 Upvote 0
It's been deemed serious enough to warrant a BBC article as well - https://www.bbc.co.uk/news/technology-59638308
aeric Expert Licensed User Longtime User May 10, 2022 #8 b4x-de said: it contains Log4J classes in com.mchange.v2.log Click to expand... Code: Copy <dependsOn>mchange-commons-java-0.2.11</dependsOn> https://mvnrepository.com/artifact/com.mchange/mchange-commons-java/0.2.11 While this dependency is using Log4j 1.x and reported with a vulnerability CVE-2017-5929, it is not same as the vulnerabilities affected from Log4j 2.x CVE-2021-45105, CVE-2021-45046 and CVE-2021-44228. Keep our finger crossed. Upvote 0
b4x-de said: it contains Log4J classes in com.mchange.v2.log Click to expand... Code: Copy <dependsOn>mchange-commons-java-0.2.11</dependsOn> https://mvnrepository.com/artifact/com.mchange/mchange-commons-java/0.2.11 While this dependency is using Log4j 1.x and reported with a vulnerability CVE-2017-5929, it is not same as the vulnerabilities affected from Log4j 2.x CVE-2021-45105, CVE-2021-45046 and CVE-2021-44228. Keep our finger crossed.
