4 ms·
There's a new CVE filed for it, just now. And here are the others for reference. 12/18 - https://nvd.nist.gov/vuln/detail/CVE-2021-45105 https://nvd.nist.gov/v
by imglorp 5y ago
There's a new CVE filed for it, just now. And here are the others for reference.
12/18 - https://nvd.nist.gov/vuln/detail/CVE-2021-45105 https://nvd.nist.gov/vuln/detail/CVE-2021-45105 Score: -
12/14 - https://nvd.nist.gov/vuln/detail/CVE-2021-45046 https://nvd.nist.gov/vuln/detail/CVE-2021-45046 Score: 3.7
12/14 - https://nvd.nist.gov/vuln/detail/CVE-2021-4104 https://nvd.nist.gov/vuln/detail/CVE-2021-4104 Score: 8.1
12/10 - https://nvd.nist.gov/vuln/detail/CVE-2021-44228 https://nvd.nist.gov/vuln/detail/CVE-2021-44228 Score: 10.0
- smarx007 5y agoCVE page for 45046 says that the score is being revised. Log4j self-assesses 9.0/10 as the new score: https://logging.apache.org/log4j/2.x/security.html https://logging.apache.org/log4j/2.x/security.html (see under Fixed in Log4j 2.12.2 (Java 7) and Log4j 2.16.0 (Java 8)). And the new CVE-2021-45105 is self-assessed to have a CVSS of 7.5/10 (see the same page above).
- spydum 5y agoWhat surprises me is the scoring... for a non-default config. Seems a little high, but these seem inflated, maybe just because of the attention.
- smarx007 5y agoI think the scoring is done from the assumption that many users may be concatenating a log string instead of formatting it. If you format your log strings, 7.5 is definitely too high.
- majou 5y agoThe scoring has little merit in general.
- terom 5y agoParticularly with the `${ctx:...}` vs `%X{...}` distinction. For a plain DoS, which only affects `${ctx:...}` usage? I wouldn't panic, fix it if someone manages to actually exploit it... It's goods new so far that with more people/time and attention paid to the log4j exloits, the vulnerabilities are just getting narrower in scope and lesser in impact.