The Log4j vulnerability affects everything from the cloud to developer
tools and security devices. Here's what to look for, according to the
latest information.


by Liam Tung <https://www.zdnet.com/meet-the-team/eu/liam-tung/>

A flaw in Log4j, a Java library for logging error messages in
applications, is the most high-profile security vulnerability on the
internet right now and comes with a severity score of 10 out of 10.

The library is developed by the open-source Apache Software Foundation
and is a key Java-logging framework. Sincelast week's alert by CERT New
Zealand <https://www.zdnet.com/article/security-warning-new-zero-day-in-the-log4j-java-library-is-already-being-exploited/>thatCVE-2021-44228
<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228>, a
remote code execution flaw in Log4j, was already being exploited in the
wild, warnings have been issued by several national cybersecurity
agencies, including the Cybersecurity and Infrastructure Security Agency
(CISA) and the UK's National Cyber Security Centre (NCSC). Internet infrastructure provider Cloudflare said Log4j exploits started on
December 1 <https://www.zdnet.com/article/log4j-rce-activity-began-on-december-1-as-botnets-start-using-vulnerability/>.


https://www.zdnet.com/article/log4j-zero-day-flaw-what-you-need-to-know-and-how-to-protect-yourself/

Bill

--
I don't want to say that I'm old and worn out, but I'm never anywhere near the curb on trash day

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)