{"id":102661,"date":"2021-12-19T03:36:43","date_gmt":"2021-12-19T01:36:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/eshhyo-odna-uyazvimost-v-log4j-2-problemy-v-log4j-zatragivayut-8-maven-paketov"},"modified":"2021-12-19T03:36:43","modified_gmt":"2021-12-19T01:36:45","slug":"eshhyo-odna-uyazvimost-v-log4j-2-problemy-v-log4j-zatragivayut-8-maven-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/eshhyo-odna-uyazvimost-v-log4j-2-problemy-v-log4j-zatragivayut-8-maven-paketov","title":{"rendered":"Another vulnerability in Log4j 2. Issues in Log4j affect 8% of Maven packages.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Another vulnerability has been identified in the Log4j 2 library (CVE-2021-45105), which, unlike two previous issues, is classified as dangerous but not critical. This new issue can cause denial of service and manifests as looping and crashes when processing certain strings. The vulnerability has been fixed in the Log4j 2.17 release published just a few hours ago. The threat of the vulnerability is mitigated by the fact that the issue only occurs on systems running Java 8. <\/p>\n
Systems that rely on contextual queries (Context Lookup), such as ${ctx:var}, to determine log output format are vulnerable. Versions of Log4j from 2.0-alpha1 to 2.16.0 lacked protection against uncontrolled recursion, allowing an attacker to manipulate the substitution value, leading to infinite loops that could exhaust stack space and crash the process. In particular, the issue arose when substituting values like «${${::-${::-$${::-j}}}}». <\/p>\n
Additionally, researchers from Blumira suggested an attack variant on vulnerable Java applications that do not accept external network requests. For example, developer systems or users of Java applications can be targeted. The essence of the method is that if a system has vulnerable Java processes that only accept network connections from localhost or handle RMI requests (Remote Method Invocation, port 1099), an attack can be executed using JavaScript code when users open a malicious page in their browser. To establish a connection with the network port of the Java application during such an attack, the WebSocket API is used, which does not impose same-origin restrictions like HTTP requests do (WebSocket can also be used for scanning network ports on localhost to identify existing network handlers).
<\/center> <\/p>\n
Also of interest are the vulnerability assessment results related to Log4j libraries published by Google. According to Google, the issue affects 8% of all packages in the Maven Central repository. Specifically, 35,863 Java packages associated with Log4j are vulnerable due to direct and indirect dependencies. Log4j is used as a direct first-level dependency in only 17% of cases, while 83% of vulnerable packages link through intermediate packages dependent on Log4j, i.e., second and higher-level dependencies (21% at the second level, 12% at the third, 14% at the fourth, 26% at the fifth, and 6% at the sixth). The pace of vulnerability fixes leaves much to be desired; a week after the vulnerability was identified, the issue has been resolved in only 4,620 out of 35,863 identified packages, or 13%.
<\/center> <\/p>\n
Meanwhile, the U.S. Cybersecurity and Infrastructure Security Agency has issued an emergency directive requiring federal agencies to identify information systems vulnerable to Log4j and to implement updates to mitigate the issue by December 23. By December 28, organizations are required to report on the actions taken. To facilitate the identification of affected systems, a list of products with confirmed vulnerabilities has been prepared (with over 23,000 applications on the list). \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Another](\"\/wp-content\/uploads\/2021\/12\/811931e8c3ae3f3f3c2e81db361034e6.jpg\")
<\/center> <\/p>\n![\"Another](\"\/wp-content\/uploads\/2021\/12\/1e61b09923c7e055fa635545f1b3de6b.jpg\")
<\/center> <\/p>\n