Security Bulletin: Vulnerabilities in Apache Log4j may affect Cúram Social Program Management (CVE-2021-44228 , CVE-2021-45046)

Summary IBM Cúram Social Program Management SPM uses the Apache Log4j libraries for SPM logging infrastructure. There are publicly known vulnerabilities for Apache Log4j which could allow a remote attacker to execute arbitrary code on the system. Vulnerability Details CVEID: CVE-2021-44228...

Critical: Red Hat Security Advisory: OpenShift Container Platform 4.6.52 security update

Red Hat OpenShift Container Platform release 4.6.52 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which...

wolf-tools

wolf-tools Open source tools and scripts by Arctic Wolf:...

Critical: Red Hat Security Advisory: OpenShift Container Platform 4.7.40 security update

Red Hat OpenShift Container Platform release 4.7.40 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which...

Critical: Red Hat Security Advisory: OpenShift Container Platform 4.8.24 security update

Red Hat OpenShift Container Platform release 4.8.24 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which...

Security Bulletin: Multiple vulnerabilities in WebSphere Application Server shipped with IBM WebSphere Application Server Patterns

Summary WebSphere Application Server is shipped as a component of IBM WebSphere Application Server Patterns. Information about security vulnerabilities affecting WebSphere Application Server have been published in a security bulletin. Vulnerability Details CVEID: CVE-2021-4104 DESCRIPTION: Apache...

Critical: Red Hat Security Advisory: OpenShift Container Platform 4.7.40 security update

Red Hat OpenShift Container Platform release 4.7.40 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which...

Critical: Red Hat Security Advisory: OpenShift Container Platform 4.6.52 security update

Red Hat OpenShift Container Platform release 4.6.52 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which...

Hackers Begin Exploiting Second Log4j Vulnerability as a Third Flaw Emerges

Web infrastructure company Cloudflare on Wednesday revealed that threat actors are actively attempting to exploit a second bug disclosed in the widely used Log4j logging utility, making it imperative that customers move quickly to install the latest version as a barrage of attacks continues to...

Critical: Red Hat Security Advisory: OpenShift Container Platform 4.6.z security update

An update is now available for Red Hat OpenShift Container Platform 4.6. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Critical: aws-kinesis-agent

Issue Overview: Amazon Kinesis Agent versions within Amazon Linux 2 AL2 prior to aws-kinesis-agent-2.0.4-1 included a version of Apache Log4j affected by CVE-2021-44228 and CVE-2021-45046. The Amazon Kinesis Agent has been updated to aws-kinesis-agent-2.0.4-1 within Amazon Linux 2 that mitigates...

Amazon Linux 2 : aws-kinesis-agent (ALAS-2021-1730)

The version of aws-kinesis-agent installed on the remote host is prior to 2.0.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1730 advisory. Amazon Kinesis Agent versions within Amazon Linux 2 AL2 prior to aws-kinesis-agent-2.0.4-1 included a version of...

Debian DSA-5022-1 : apache-log4j2 - security update

The remote Debian 10 / 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5022 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j, a Logging Framework for Java, was incomplete in certain non-default configurations. This...

Critical: Red Hat Security Advisory: OpenShift Container Platform 4.8.24 extras security update

Red Hat OpenShift Container Platform release 4.8.24 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which...

How to Protect Your Applications Against Log4Shell With tCell

By now, we’re sure you’re familiar with all things Log4Shell – but we want to make sure we share how to protect your applications. Applications are a critical part of any organization’s attack surface, and we’re seeing thousands of Log4Shell attack attempts in our customers' environments every...

Apache’s Fix for Log4Shell Can Lead to DoS Attacks

As if finding one easily exploited and extremely dangerous flaw in the ubiquitous Java logging library Apache Log4j hadn’t already turned the Internet security community on its ear, researchers now have found a new vulnerability in Apache’s patch issued to mitigate it. Last Thursday security...

OPENSUSE-SU-2021:4094-1 Security update for log4j

This update for log4j fixes the following issue: CVE-2021-44228: The previously published fix by upstream turned out to be incomplete. Therefore, upstream has recommended disabling JNDI support in log4j by default to be completely sure that this vulnerability cannot be exploited. This update...

Exploit for Expression Language Injection in Apache Log4J

CVE-2021-45046-Info Oh no another one POC $ctx:apive...

Second Log4j Vulnerability (CVE-2021-45046) Discovered — New Patch Released

UPDATE — The severity score of CVE-2021-45046, originally classified as a DoS bug, has since been revised from 3.7 to 9.0, to reflect the fact that an attacker could abuse the vulnerability to send a specially crafted string that leads to "information leak and remote code execution in some...

Ubuntu 20.04 LTS : Apache Log4j 2 vulnerability (USN-5197-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5197-1 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. An attacker could use...