Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

Re:Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sh... by eganist on Monday December 13, 2021 @02:38PM (#29543492)

you could probably fire a bullet in any direction and hit a company with hundreds of apps or appliances affected.

I recognize this probably isn't helpful on its face, but the best way to think of it is: if it's a Java app (or heck even possibly just an app running on the JVM) that uses the most recent major version (2.x before 2.15.0, the patch) of the most common logging logic, it's affected.

And that list in the enterprise space gets exceptionally long. Maybe not so much on client machines, but servers/etc absolutely.

Even companies not known for using Java for their own apps are probably relying on appliances or systems which run their own vulnerable Java apps.

[ Parent | on HN ]

Re:Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sh... by tyingq on Monday December 13, 2021 @02:53PM (#29543717)

There's also a tendency for a lot of Cybersecurity type software to use java and log4j. Things like SAML, SSO, code scanning, etc. I'm fighting a bit of schadenfreude watching all of those vendors furiously trying to get their stories together.

[ Parent | on HN ]