Log4Shell update: second Log4j vulnerability published
1–10 of 289 posts
Re: Log4Shell update: second Log4j vulnerability published
#2We spent a few hours writing this today due to the sh*tstorm that's hit the internet since this 2nd CVE was posted up. It took us some time to do a security analysis of it and to publish our findings.
If you've patched against Log4Shell, please read this to make sure you're not still vulnerable to this 2nd CVE. In some cases, you're still vulnerable depending on how you patched.
In response to this, Apache published log4j 2.16.0 to mitigate the bugs in prior versions (including 2.15.0, the release that was supposed to mitigate Log4Shell initially)
Re: Log4Shell update: second Log4j vulnerability published
#3This is the vulnerability that keeps on giving.
The annoying thing is, since it is evolving and attacks are spreading (and it has rightly gotten the attention of nearly everyone's IT department), we're hitting a stage where almost every customer is emailing daily asking for updates on mitigations based on evolving CVE discussions.
I'd rather people be over-vigilant rather than pass on it, but mitigation is taking a back seat to having to re-read and re-evaluate things multiple times per day, and communicate a lot more than usual to assuage people's nerves.
Re: Log4Shell update: second Log4j vulnerability published
#4Round 2 of Log4j ransomware incoming.
Re: Log4Shell update: second Log4j vulnerability published
#5My kids are tremendously disappointed that the Minecraft server is not coming back up in the near future.
Re: Log4Shell update: second Log4j vulnerability published
#6This vulnerability is like PFAS, it's going to be around forever. log4j is in so many things, things no one might think would have it. Probably a ton of old stuff people don't think to update or can (thinking consumer routers).
Re: Log4Shell update: second Log4j vulnerability published
#7[deleted]
Re: Log4Shell update: second Log4j vulnerability published
#8Write simple software. The fact that log.Debug(someString) means someString is actually a format string in an elaborate domain-specific language instead of simple goddamned text is emblematic of the crisis the industry is in.
Re: Log4Shell update: second Log4j vulnerability published
#9looks like most end users wont be affected by this one, unlike the previous. never seen these options enabled in the wild
Re: Log4Shell update: second Log4j vulnerability published
#10My kids are tremendously disappointed that the Minecraft server is not coming back up in the near future.
run a Digital Ocean droplet hosting the server? It's up to you if the costs justify the benefits.