9 ms·

CISA Director on Log4j Vulnerability

119 points by panarky 5y ago

mclarke 5y ago
I’m sure this is the only community that might pay attention to a software BOM as mentioned in the article, but this is a great idea and makes a lot of sense (to me as a consumer at least).
- goalieca 5y ago
  Developers are relying more and more on automated scanners and the likes to manage this. Your modern python or javaScript stack just has way too many packages and they change daily. Just look at your dependency lockfile balloon when a random dependency updates a point and brings in a few more packages. It’s really a horrible thing. I’d like to say the scanners were fast but not fast enough because the first wave of attacks was nearly instant. This was definitely a nightmare scenario where a simple unauthenticated GET could pull in a kit that was already live and ready to go.
  - closeparen 5y ago
    I don't think anyone in the Java community is surprised to find they have a dependency on Log4j. It's one of those libraries used so widely that it's practically stdlib.
- phkahler 5y ago
  In the production of electronic things I've been pointing out that software needs to be on the BOM for other reasons. It is so often overlooked and considered zero cost even though companies pay people to develop it. Making people look at a BOM would also discourage the mess that is npm.
  - imglorp 5y ago
    Most systems use package management now; npm is only the poster child. Reviewing a stack of BOMs is going to be a challenge for any organization. Say your production Linux has 1000 packages. Each of those might have hundreds or thousands of deps in varying versions, in their respective package managers (BOMs). Business needs to step up its process game. How are BOMS (dep lists) reviewed? Do we expect zero CVEs? How do you filter out false positives, or irrelevant ones? Do you dump everything with that dep or help the maintainer fix it? Many questions.
    - phkahler 5y ago
      One outcome of reviewing a BOM will be people asking "why do we have 5000 little dependencies? I thought we were paying YOU to write software."
- bob1029 5y ago
  We do something along this axis with our products. We have to be able to provide B2B software that will be stable on timelines measured in half-decades (per contractual requirements), so the specific vendors we decide to depend upon are a huge part of our decision making process. I will happily admit we probably wrote a little bit too much stuff in-house, but the number of clear wins easily outweighs the "no DIY allowed" concerns. Getting us to vendor out something like logging/tracing/telemetry would take an act of god at this point. We explicitly spent a week ripping out Microsoft's byzantine logging from AspNetCore in favor of something we could trust and understand. Our entire logging framework now lives in 1 class file and consists of maybe 30 useful lines of source code. None of them have the capability to reach out to a remote host, download a DLL and then execute it in the current context. This sort of problem we are seeing with Log4j today is precisely the sort of experience we hope to avoid by doing a lot of our tooling in-house. I think those who parroted "don't reinvent the wheel" over and over like it's some doomsday cult should accept some shame for the situation many developer ecosystems find themselves in today.
seb1204 5y ago
Unless they spell out how they proactively support the one man hobbyist maintainer I don't believe them. https://xkcd.com/2347 https://xkcd.com/2347
- sam_lowry_ 5y ago
  Indeed. The statement is so much disconnected from the reality that it is embarrasing to read.
- teddyh 5y ago
  There are a few initiatives to fix that, though: https://www.coreinfrastructure.org/ https://www.coreinfrastructure.org/ http://www.loadsharers.org/ http://www.loadsharers.org/
- lankyinspector 5y ago
  I wholehearted agree that we, as an industry, need to sort out the issue of open source maintenance compensation, but out of all the projects that we could pick to make a stand, I can't think of a worse example. There's no need to support these hobbyists in particular, it's a logging library for Java that had no reason to be written, that fulfills no need, that no one forced them to write and makes the entire ecosystem worse by piggying back on the "log4j" fame. By the time log4j2 was released, slf4j + logback was already the spiritual successor to log4j 1, superior in all aspects, and maintained by someone who actually knows what they are doing. log4j2 has no reason for existing, other than the hubris of their own authors, who, as the entire world just found out, are not qualified to write a logging library. sl4fj + logback is the saner (3rd party) logging interface. More logging interfaces make it harder for every JVM developer who need to keep track of them all, perform exclusions in their build system and then explicitly include an SLF4J bridge for whatever "logging interface du jour" the author of some other library that you actually want to use picked. So you can't really say the log4j2 authors are doing it "out of the goodness of their own heart", they're injecting unwanted garbage onto my dependencies because someone who wrote an actually useful library just wanted logging to work and bumped a log4j1 dependency to log4j2, usually because they're focused on writing a useful library that people want to use and are unaware logging in Java is a shitshow (can't blame them). Would you say that we should also be thankful of malware developers who are doing it for free? The log4j2 team can whine about how they're being unfairly attacked when they're doing unpaid work, but the fact is that they wrote software that had no business existing and actively makes the life of everyone WORSE by simply existing. If they don't like it, they can do the honorable thing, put the project on security maintenance mode and and redirect everyone to slf4j + logback.
taspeotis 5y ago
I think CycloneDX [1] is the go-to SBOM specification these days. [1] https://cyclonedx.org/ https://cyclonedx.org/
- mhoad 5y ago
  I was just digging into Cloud Native Buildpacks (buildpacks.io) as an alternative to Dockerfiles yesterday and realised that they actually have SBOM generation built into them for popular languages which is a really nice easy security infrastructure upgrade for everyone using them.
rlt 5y ago
“we are also convening a national call with critical infrastructure stakeholders on Monday afternoon” Shouldn’t this be happening, like, yesterday?
- cscurmudgeon 5y ago
  Its the weekend! Security can wait. /s
  - nix23 5y ago
    For some company's that's true, in one i worked we shutdown all systems (including router and firewall) every Friday at 18:00 ;)
    - olliej 5y ago
      I recall some US gov agency, possibly the IRS of all things, that would only accept forms being submitted during US working hours. Because the computers also need time off I guess?
      - lkschubert8 5y ago
        I've heard of similar things being done for ADA compliance. Something about requiring a phone line to be up at all the same times as the website so instead of a 24/7 call center you just turn the site off.
      - detaro 5y ago
        In some cases I know (with smaller orgs) it happens because someone put a requirement in that they need to react to incidents with the service within X hours, but didn't provide the budget for the employees or external service needed to have that 24/7.
- TeeMassive 5y ago
  Do not worry, because: > We have established a JCDC senior leadership group to coordinate collective action and ensure shared visibility into both the prevalence of this vulnerability and threat activity Very clearly they know what they will be doing.
jalino23 5y ago
do I need to worry about this as a frontend web developer?
- lixtra 5y ago
  Do you have any java in your application stack (i.e. elastic search)? If there’s no java, then there’s no log4j and you may worry about other issues.
  - bushbaba 5y ago
    *are you using ElasticSearch, flink, spark, prest,…etc. do they read in user data supplied by your front end. Could this user data end up being logged intentionally or part of an error log output. If so, you might be vulnerable and should update those systems.
    - charcircuit 5y ago
      those don't run on the front end
      - Xylakant 5y ago
        It doesn’t matter. An nginx web server logging an odd user agent, elasticsearch picks it up. And then, due to some error triggered by the attacker, the content of the webserver log line gets logged on the ES side (for example if it violates a constraint). Frontend bypassed, attack owns ES. I’ve spent my weekend celebrating that I don’t have Java software in a stack that I’m responsible for right now - and feeling sorry for my ex-colleagues that do. Edit: I haven’t tested or checked whether ES is vulnerable or not - but given the severity of this issue I’d default to the pessimistic stance of assuming it is, until proven otherwise.
        wiredfool 5y ago
        I'm seeing on 7.15, logstash and elasticsearch both ship log4j in the vulnerable range, but in my case, I'm running a new enough java that it shouldn't be an issue.
tex0 5y ago
Someone should tell them that any system that it logging user supplied data can be affected. Not only "user facing" systems. Not even a WAF can protect these.
- Thorrez 5y ago
  If the WAF blocks any request containing "{", that would be fairly safe, right? Yes, some attacks could still get through (e.g. a backend that receives requests base64-encoded), but that's the case generally with WAFs I think.
  - simcop2387 5y ago
    Thag would also mean blocking any apis that use json. This would not end well in the short term, or long term.
    - Thorrez 5y ago
      You could probably write a more advanced check than just "{" that would let most JSON through while still blocking the attack.
  - miohtama 5y ago
    Cloudflare did something along these lines: https://blog.cloudflare.com/how-cloudflare-security-responded-to-log4j2-vulnerability/ https://blog.cloudflare.com/how-cloudflare-security-responde...
  - PeterisP 5y ago
    The devil is in the details. As a random example, you might have a process where all the pre-WAF requests (or explicitly the requests blocked by WAF) get forwarded to a log analysis system that itself uses log4j and is vulnerable, allowing the attacker to gain RCE in your monitoring infrastructure. Also, blocking any request containing "{" is tricky - like, that's so generic that it's time-consuming to verify that it won't break anything, and it's very likely that JSON is used somewhere in that application traffic, so you can't simply do that.
eitland 5y ago
There's a lot of talk now about a number of things including web application firewalls and how we must fund open source and I hope something good comes out of it. However, the thing that I wonder is why we still are in a position where every single application and every single dependency can attempt to load dlls (ref npm hacks lately) or reach out to the network? Why is Deno the only one who seems to have a good solution for this, and why doesn't Deno have more traction? I know one can do a lot more using outbound firewalls and selinux but after seeing how brilliantly Deno solves this I wonder why not every program lets me do this.
- beebeepka 5y ago
  I would like to use Deno but I am not in a position of power even if I was, it's not always easy to switch, especially with a full backlog. Anyway, how does Deno solve this?
  - eitland 5y ago
    I'll start with the question: Deno solves this by making you specify on the command line or in a config file what an application should have access to, for instance for a simple web application you can specify that it only has read acesss to one folder of static files, write access to the log folder and can only connect to the postgres server. It is also very simple, see: https://deno.land/manual@v1.16.4/getting_started/permissions https://deno.land/manual@v1.16.4/getting_started/permissions As for the first part, I'm in the lucky position where nobody can just rewrite everything to todays flavor of js, but where we can decide in the team to test out new technology when we have a chance to, for example on a new small project. There's another guy on the team that is enthusiastic about it too and I guess he'll throw together a demo soon, then we'll discuss it.
    - beebeepka 5y ago
      Thanks for your time. I am about to start a new personal project and your post, combined with some curiosity, is all I needed to hear. I've reached a point where doing the same thing with the same tech is making me feel uneasy.
trollied 5y ago
I quite liked the exploit that made a Minecraft server serve Doom to its clients: https://twitter.com/gegy1000/status/1469714451716882434?s=21 https://twitter.com/gegy1000/status/1469714451716882434?s=21
- deleted 5y ago
  [deleted]
JimmyRuska 5y ago
This is pretty awful. Seems easy to fuzz every input form and API param to see which websites are vulnerable just by seeing which sites get a response. Once a site is found to be vulnerable, a malicious actor can try to funnel all logs to an external server, add a remote shell, and potentially scan the production network of whatever was running log4j. Once in the internal network, they can again scan for log4j exploits. Too many groups blanket whitelist cloud IPs like AWS lambda. Seems like there will be a cascade of experian-level data leaks coming. Even if things are somewhat locked down we've seen time and time again, there's internal sprawl where access to an internal bucket or git repo, or an escalation in the CI/CD pipelines leads to full access, then data dumps/leaks.
- tgv 5y ago
  What do you think is happening? I’ve already found a few requests for / with a referrer that starts with ${jdni:
marksimi 5y ago
Governments should 1. Step up and shoulder part of the finding for maintainers 2. Close their double quotes on press releases
- tmerse 5y ago
  One of Sovereigntechfunds goal is to support maintainers of critical open source infrastructure with public money. https://sovereigntechfund.de/en https://sovereigntechfund.de/en Germany for now, but plans are to expand "up" to Europe as far as I know (we are all in the same boat, aren't we)
lolive 5y ago
The french announcement mentions this: "In general, it seems that the use of a Java runtime environment in version 8u121 or later makes it possible to guard against the main attack vector mentioned by the researchers behind the discovery." Is it correct? https://www.cert.ssi.gouv.fr/alerte/CERTFR-2021-ALE-022/ https://www.cert.ssi.gouv.fr/alerte/CERTFR-2021-ALE-022/
- cesarb 5y ago
  As has been commented several times on other threads here on HN, a new enough Java only protects against one kind of exploit (directly loading arbitrary bytecode) but not others (serialization tricks to execute arbitrary function calls, or data exfiltration).
vaxmeup 5y ago
STFU. CISA just needs to be shutdown already. "We are taking urgent action" Dood, you aren't doing anything because you can't do anything. Absolutely hate worthless gov. agencies like this.
debug-desperado 5y ago
Spring Boot apps aren't affected by this unless you switched logging frameworks. Nor any JBoss frameworks. How many people actually use Log4j2? It's probably in 4th or 5th place among Java logging frameworks, and likely still has less uptake than the original Log4j.

119 points by panarky 5y ago

I’m sure this is the only community that might pay attention to a software BOM as mentioned in the article, but this is a great idea and makes a lot of sense (to me as a consumer at least).

goalieca 5y ago
Developers are relying more and more on automated scanners and the likes to manage this. Your modern python or javaScript stack just has way too many packages and they change daily. Just look at your dependency lockfile balloon when a random dependency updates a point and brings in a few more packages. It’s really a horrible thing. I’d like to say the scanners were fast but not fast enough because the first wave of attacks was nearly instant. This was definitely a nightmare scenario where a simple unauthenticated GET could pull in a kit that was already live and ready to go.
- closeparen 5y ago
  I don't think anyone in the Java community is surprised to find they have a dependency on Log4j. It's one of those libraries used so widely that it's practically stdlib.
phkahler 5y ago
In the production of electronic things I've been pointing out that software needs to be on the BOM for other reasons. It is so often overlooked and considered zero cost even though companies pay people to develop it. Making people look at a BOM would also discourage the mess that is npm.
- imglorp 5y ago
  Most systems use package management now; npm is only the poster child. Reviewing a stack of BOMs is going to be a challenge for any organization. Say your production Linux has 1000 packages. Each of those might have hundreds or thousands of deps in varying versions, in their respective package managers (BOMs). Business needs to step up its process game. How are BOMS (dep lists) reviewed? Do we expect zero CVEs? How do you filter out false positives, or irrelevant ones? Do you dump everything with that dep or help the maintainer fix it? Many questions.
  - phkahler 5y ago
    One outcome of reviewing a BOM will be people asking "why do we have 5000 little dependencies? I thought we were paying YOU to write software."
bob1029 5y ago
We do something along this axis with our products. We have to be able to provide B2B software that will be stable on timelines measured in half-decades (per contractual requirements), so the specific vendors we decide to depend upon are a huge part of our decision making process. I will happily admit we probably wrote a little bit too much stuff in-house, but the number of clear wins easily outweighs the "no DIY allowed" concerns. Getting us to vendor out something like logging/tracing/telemetry would take an act of god at this point. We explicitly spent a week ripping out Microsoft's byzantine logging from AspNetCore in favor of something we could trust and understand. Our entire logging framework now lives in 1 class file and consists of maybe 30 useful lines of source code. None of them have the capability to reach out to a remote host, download a DLL and then execute it in the current context. This sort of problem we are seeing with Log4j today is precisely the sort of experience we hope to avoid by doing a lot of our tooling in-house. I think those who parroted "don't reinvent the wheel" over and over like it's some doomsday cult should accept some shame for the situation many developer ecosystems find themselves in today.

seb1204 5y ago

Unless they spell out how they proactively support the one man hobbyist maintainer I don't believe them. https://xkcd.com/2347 https://xkcd.com/2347

sam_lowry_ 5y ago
Indeed. The statement is so much disconnected from the reality that it is embarrasing to read.
teddyh 5y ago
There are a few initiatives to fix that, though: https://www.coreinfrastructure.org/ https://www.coreinfrastructure.org/ http://www.loadsharers.org/ http://www.loadsharers.org/
lankyinspector 5y ago
I wholehearted agree that we, as an industry, need to sort out the issue of open source maintenance compensation, but out of all the projects that we could pick to make a stand, I can't think of a worse example. There's no need to support these hobbyists in particular, it's a logging library for Java that had no reason to be written, that fulfills no need, that no one forced them to write and makes the entire ecosystem worse by piggying back on the "log4j" fame. By the time log4j2 was released, slf4j + logback was already the spiritual successor to log4j 1, superior in all aspects, and maintained by someone who actually knows what they are doing. log4j2 has no reason for existing, other than the hubris of their own authors, who, as the entire world just found out, are not qualified to write a logging library. sl4fj + logback is the saner (3rd party) logging interface. More logging interfaces make it harder for every JVM developer who need to keep track of them all, perform exclusions in their build system and then explicitly include an SLF4J bridge for whatever "logging interface du jour" the author of some other library that you actually want to use picked. So you can't really say the log4j2 authors are doing it "out of the goodness of their own heart", they're injecting unwanted garbage onto my dependencies because someone who wrote an actually useful library just wanted logging to work and bumped a log4j1 dependency to log4j2, usually because they're focused on writing a useful library that people want to use and are unaware logging in Java is a shitshow (can't blame them). Would you say that we should also be thankful of malware developers who are doing it for free? The log4j2 team can whine about how they're being unfairly attacked when they're doing unpaid work, but the fact is that they wrote software that had no business existing and actively makes the life of everyone WORSE by simply existing. If they don't like it, they can do the honorable thing, put the project on security maintenance mode and and redirect everyone to slf4j + logback.

taspeotis 5y ago

I think CycloneDX [1] is the go-to SBOM specification these days. [1] https://cyclonedx.org/ https://cyclonedx.org/

mhoad 5y ago
I was just digging into Cloud Native Buildpacks (buildpacks.io) as an alternative to Dockerfiles yesterday and realised that they actually have SBOM generation built into them for popular languages which is a really nice easy security infrastructure upgrade for everyone using them.

rlt 5y ago

“we are also convening a national call with critical infrastructure stakeholders on Monday afternoon” Shouldn’t this be happening, like, yesterday?

cscurmudgeon 5y ago
Its the weekend! Security can wait. /s
- nix23 5y ago
  For some company's that's true, in one i worked we shutdown all systems (including router and firewall) every Friday at 18:00 ;)
  - olliej 5y ago
    I recall some US gov agency, possibly the IRS of all things, that would only accept forms being submitted during US working hours. Because the computers also need time off I guess?
    - lkschubert8 5y ago
      I've heard of similar things being done for ADA compliance. Something about requiring a phone line to be up at all the same times as the website so instead of a 24/7 call center you just turn the site off.
    - detaro 5y ago
      In some cases I know (with smaller orgs) it happens because someone put a requirement in that they need to react to incidents with the service within X hours, but didn't provide the budget for the employees or external service needed to have that 24/7.
TeeMassive 5y ago
Do not worry, because: > We have established a JCDC senior leadership group to coordinate collective action and ensure shared visibility into both the prevalence of this vulnerability and threat activity Very clearly they know what they will be doing.

jalino23 5y ago

do I need to worry about this as a frontend web developer?

lixtra 5y ago
Do you have any java in your application stack (i.e. elastic search)? If there’s no java, then there’s no log4j and you may worry about other issues.
- bushbaba 5y ago
  *are you using ElasticSearch, flink, spark, prest,…etc. do they read in user data supplied by your front end. Could this user data end up being logged intentionally or part of an error log output. If so, you might be vulnerable and should update those systems.
  - charcircuit 5y ago
    those don't run on the front end
    - Xylakant 5y ago
      It doesn’t matter. An nginx web server logging an odd user agent, elasticsearch picks it up. And then, due to some error triggered by the attacker, the content of the webserver log line gets logged on the ES side (for example if it violates a constraint). Frontend bypassed, attack owns ES. I’ve spent my weekend celebrating that I don’t have Java software in a stack that I’m responsible for right now - and feeling sorry for my ex-colleagues that do. Edit: I haven’t tested or checked whether ES is vulnerable or not - but given the severity of this issue I’d default to the pessimistic stance of assuming it is, until proven otherwise.
      - wiredfool 5y ago
        I'm seeing on 7.15, logstash and elasticsearch both ship log4j in the vulnerable range, but in my case, I'm running a new enough java that it shouldn't be an issue.

tex0 5y ago

Someone should tell them that any system that it logging user supplied data can be affected. Not only "user facing" systems. Not even a WAF can protect these.

Thorrez 5y ago
If the WAF blocks any request containing "{", that would be fairly safe, right? Yes, some attacks could still get through (e.g. a backend that receives requests base64-encoded), but that's the case generally with WAFs I think.
- simcop2387 5y ago
  Thag would also mean blocking any apis that use json. This would not end well in the short term, or long term.
  - Thorrez 5y ago
    You could probably write a more advanced check than just "{" that would let most JSON through while still blocking the attack.
- miohtama 5y ago
  Cloudflare did something along these lines: https://blog.cloudflare.com/how-cloudflare-security-responded-to-log4j2-vulnerability/ https://blog.cloudflare.com/how-cloudflare-security-responde...
- PeterisP 5y ago
  The devil is in the details. As a random example, you might have a process where all the pre-WAF requests (or explicitly the requests blocked by WAF) get forwarded to a log analysis system that itself uses log4j and is vulnerable, allowing the attacker to gain RCE in your monitoring infrastructure. Also, blocking any request containing "{" is tricky - like, that's so generic that it's time-consuming to verify that it won't break anything, and it's very likely that JSON is used somewhere in that application traffic, so you can't simply do that.

eitland 5y ago

There's a lot of talk now about a number of things including web application firewalls and how we must fund open source and I hope something good comes out of it. However, the thing that I wonder is why we still are in a position where every single application and every single dependency can attempt to load dlls (ref npm hacks lately) or reach out to the network? Why is Deno the only one who seems to have a good solution for this, and why doesn't Deno have more traction? I know one can do a lot more using outbound firewalls and selinux but after seeing how brilliantly Deno solves this I wonder why not every program lets me do this.

beebeepka 5y ago
I would like to use Deno but I am not in a position of power even if I was, it's not always easy to switch, especially with a full backlog. Anyway, how does Deno solve this?
- eitland 5y ago
  I'll start with the question: Deno solves this by making you specify on the command line or in a config file what an application should have access to, for instance for a simple web application you can specify that it only has read acesss to one folder of static files, write access to the log folder and can only connect to the postgres server. It is also very simple, see: https://deno.land/manual@v1.16.4/getting_started/permissions https://deno.land/manual@v1.16.4/getting_started/permissions As for the first part, I'm in the lucky position where nobody can just rewrite everything to todays flavor of js, but where we can decide in the team to test out new technology when we have a chance to, for example on a new small project. There's another guy on the team that is enthusiastic about it too and I guess he'll throw together a demo soon, then we'll discuss it.
  - beebeepka 5y ago
    Thanks for your time. I am about to start a new personal project and your post, combined with some curiosity, is all I needed to hear. I've reached a point where doing the same thing with the same tech is making me feel uneasy.

trollied 5y ago

I quite liked the exploit that made a Minecraft server serve Doom to its clients: https://twitter.com/gegy1000/status/1469714451716882434?s=21 https://twitter.com/gegy1000/status/1469714451716882434?s=21

deleted 5y ago
[deleted]

JimmyRuska 5y ago

This is pretty awful. Seems easy to fuzz every input form and API param to see which websites are vulnerable just by seeing which sites get a response. Once a site is found to be vulnerable, a malicious actor can try to funnel all logs to an external server, add a remote shell, and potentially scan the production network of whatever was running log4j. Once in the internal network, they can again scan for log4j exploits. Too many groups blanket whitelist cloud IPs like AWS lambda. Seems like there will be a cascade of experian-level data leaks coming. Even if things are somewhat locked down we've seen time and time again, there's internal sprawl where access to an internal bucket or git repo, or an escalation in the CI/CD pipelines leads to full access, then data dumps/leaks.

tgv 5y ago
What do you think is happening? I’ve already found a few requests for / with a referrer that starts with ${jdni:

marksimi 5y ago

Governments should 1. Step up and shoulder part of the finding for maintainers 2. Close their double quotes on press releases

tmerse 5y ago
One of Sovereigntechfunds goal is to support maintainers of critical open source infrastructure with public money. https://sovereigntechfund.de/en https://sovereigntechfund.de/en Germany for now, but plans are to expand "up" to Europe as far as I know (we are all in the same boat, aren't we)

lolive 5y ago

The french announcement mentions this: "In general, it seems that the use of a Java runtime environment in version 8u121 or later makes it possible to guard against the main attack vector mentioned by the researchers behind the discovery." Is it correct? https://www.cert.ssi.gouv.fr/alerte/CERTFR-2021-ALE-022/ https://www.cert.ssi.gouv.fr/alerte/CERTFR-2021-ALE-022/

cesarb 5y ago
As has been commented several times on other threads here on HN, a new enough Java only protects against one kind of exploit (directly loading arbitrary bytecode) but not others (serialization tricks to execute arbitrary function calls, or data exfiltration).

vaxmeup 5y ago

STFU. CISA just needs to be shutdown already. "We are taking urgent action" Dood, you aren't doing anything because you can't do anything. Absolutely hate worthless gov. agencies like this.

debug-desperado 5y ago

Spring Boot apps aren't affected by this unless you switched logging frameworks. Nor any JBoss frameworks. How many people actually use Log4j2? It's probably in 4th or 5th place among Java logging frameworks, and likely still has less uptake than the original Log4j.