Veracode has published the results of its study on the relevance of critical vulnerabilities in the Java library Log4j, identified in recent years. Analyzing 38,278 applications used across 3,866 organizations, Veracode researchers found that 38% of them use vulnerable versions of Log4j. The main reason for the continued use of outdated code is the embedding of old libraries into projects or the labor-intensive migration from already unsupported branches to new branches, where backward compatibility is broken (according to Veracode's previous report, 79% of third-party libraries migrated into the code are never updated afterwards).
Three main categories of applications using vulnerable versions of Log4j have been identified:
- 2.8% of applications continue to use Log4j versions from 2.0-beta9 to 2.15.0, which contain the Log4Shell vulnerability (CVE-2021-44228).
- 3.8% of applications utilize Log4j2 version 2.17.0, which has fixed the Log4Shell vulnerability but still has the unpatched CVE-2021-44832 vulnerability that allows for remote code execution (RCE).
- 32% of applications use the Log4j2 1.2.x branch, which has not been supported since 2015. This branch is exposed to critical vulnerabilities CVE-2022-23307, CVE-2022-23305, and CVE-2022-23302, identified in 2022, seven years after support ended.
Source: opennet.ru
