Schwachstelle in einer Java-Komponente namens Log4j

[BS86]

Worst vulnerability in the last 10 years!

every service that uses log4j can be attacked. It does not have to be internet-facing, because the attack can be carried to internal systems via payload. log4j versions 2.0-beta9 to 2.14.1 are vulnerable, although log4j 2.10 or higher can be “hardened” against the attack with setting log4j2.formatMsgNoLookups to true or by removing the JndiLookup class. Log4j 2.15 is the first fixed version. Several hosters already said that they see internetwide scans for vulnerable services, most likely by a…