Upgraded to log4j 2.16? Surprise, there’s a 2.17 fixing DoS

Yesterday, BleepingComputer summed up all the log4j and logback CVEs known thus far.

Ever since the critical log4j zero-day saga started last week, security experts have time and time again recommended Apache version 2.16 as the safest release to be on. That advice has now changed with new version 2.17.0 released over the weekend, that fixes a seemingly minor, but ‘High’ severity Denial of Service (DoS) vulnerability that affects log4j 2.16.

The vulnerability is tracked as CVE-2021-45105 and received a CVSS score of 7.5, it is a DoS flaw that impacts log4j 2.16. Experts have pointed out that even if JNDI lookups were disabled in version 2.16, self-referential lookups remained a possibility under certain circumstances. The new advice states:

“Apache Log4j2 versions 2.0-alpha1 through 2.16.0 did not protect from uncontrolled recursion from self-referential lookups,”

A version release will push already stretched security teams as they approach the holiday season and are coping with reduced staffing levels.

Google: Over 35,000 Java packages have Log4j flaws

The development comes around the same time as Google’s analysis that reveals over 35,000 Java packages contain log4j vulnerabilities.

“More than 35,000 Java packages, amounting to over 8% of the Maven Central repository (the most significant Java package repository), have been impacted by the recently disclosed log4j vulnerabilities,” explain James Wetter and Nicky Ringland of Google’s Open Source Insights Team in yesterday’s blog post.

According to Google, the vast majority of vulnerable Java packages in Maven Central borrow log4j “indirectly”—that is log4j is a dependency of a dependency used by the package, a concept also referred to as transitive dependencies.

As reported by BleepingComputer, threat actors are targeting vulnerable servers with log4j exploits to push malware, with the Conti ransomware gang specifically eying vulnerable VMWare vCenter servers.

As such, organizations should upgrade to the latest log4j versions and continue to monitor Apache’s advisories for updates.

With thanks to the Cyber Defence Alliance and BleepingComputer. The full story is here: https://www.bleepingcomputer.com/news/security/upgraded-to-log4j-216-surprise-theres-a-217-fixing-dos/

Request A Demo: Security Awareness Training

New-school Security Awareness Training is critical to enabling you and your IT staff to connect with users and help them make the right security decisions all of the time. This isn’t a one and done deal, continuous training and simulated phishing are both needed to mobilize users as your last line of defense. Request your one-on-one demo of KnowBe4’s security awareness training and simulated phishing platform and see how easy it can be!

PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/one-on-one-demo-partners?partnerid=001a000001lWEoJAAW