{"id":102661,"date":"2021-12-19T03:36:43","date_gmt":"2021-12-19T01:36:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/eshhyo-odna-uyazvimost-v-log4j-2-problemy-v-log4j-zatragivayut-8-maven-paketov"},"modified":"2021-12-19T03:36:43","modified_gmt":"2021-12-19T01:36:45","slug":"eshhyo-odna-uyazvimost-v-log4j-2-problemy-v-log4j-zatragivayut-8-maven-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/eshhyo-odna-uyazvimost-v-log4j-2-problemy-v-log4j-zatragivayut-8-maven-paketov","title":{"rendered":"Veel \u00fcks Log4j 2 turvaauke. Log4j probleemid m\u00f5jutavad 8% Maven pakettidest","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Log4j 2 raamatukogus avastati veel \u00fcks haavatavus (CVE-2021-45105), mida, erinevalt kahest eelmisest probleemist, peetakse ohtlikuks, kuid mitte kriitiliseks. Uus probleem v\u00f5imaldab teenuse katkestamist ja avaldub teatud stringide t\u00f6\u00f6tlemisel kummitusestumise ja ootamatu sulgemisena. Haavatavus on k\u00f5rvaldatud paar tundi tagasi v\u00e4lja antud Log4j 2.17 versioonis. Haavatavuse ohtu leevendab asjaolu, et probleem ilmneb vaid Java 8 s\u00fcsteemidel. <\/p>\n

Haavatavuseid esindavad s\u00fcsteemid, mis kasutavad kontekstitundeid (Context Lookup), nagu ${ctx:var}, logifaili v\u00e4ljundiformaadi m\u00e4\u00e4ramisel. Log4j versioonides alates 2.0-alpha1 kuni 2.16.0 puudus kaitse kontrollimatu rekursiooni vastu, mis v\u00f5imaldas r\u00fcndajal manipuleerida asendamiseks kasutatava v\u00e4\u00e4rtusega, p\u00f5hjustades lukustamise, mis viis m\u00e4lu ammendumiseni ja protsessi t\u00f5rke t\u00f5ttu sulgemiseni. Eriti probleem ilmnes v\u00e4\u00e4rtuste, nagu «${${::-${::-$${::-j}}}}» asendamisel. <\/p>\n

Lisaks v\u00f5ib m\u00e4rkida, et Blumira ettev\u00f5tte teadlased on soovitanud r\u00fcnnakuv\u00f5imalust haavatavate Java-rakenduste vastu, mis ei aktsepteeri v\u00e4liseid v\u00f5rgu p\u00e4ringuid. N\u00e4iteks on v\u00f5imalik r\u00fcnnata sel moel s\u00fcsteeme, mis on m\u00f5eldud Java-rakenduste arendamiseks v\u00f5i kasutamiseks. Meetodi p\u00f5hiolemus seisneb selles, et kui kasutaja s\u00fcsteemis on haavatavaid Java-protsesse, mis aktsepteerivad v\u00f5rgu\u00fchendusi ainult kohalikult hostilt (localhost) v\u00f5i t\u00f6\u00f6tlevad RMI-p\u00e4ringuid (Remote Method Invocation, port 1099), saab r\u00fcnnaku korraldada JavaScripti koodi kaudu, mis t\u00e4idetakse, kui kasutaja avab oma brauseris pahatahtliku lehe. Sellise r\u00fcnnaku korral kasutatakse Java-rakenduse v\u00f5rguporti \u00fchendamiseks WebSocket API-d, millele vastupidiselt HTTP-p\u00e4ringutele ei kohaldata same-origin piiranguid (WebSocketit saab kasutada ka kohaliku hosti v\u00f5rguportide skaneerimiseks, et m\u00e4\u00e4rata olemasolevad v\u00f5rgu t\u00f6\u00f6tlejad).

\"Veel<\/center> <\/p>\n

Huvitavad on ka Google'i avaldatud tulemused Log4j seotud teekide haavatavuse hindamisest. Google'i andmetel m\u00f5jutab probleem 8% k\u00f5igist pakettidest, mis asuvad Maven Central'i hoidlas. T\u00e4psemalt on haavatavad 35863 Java-paketti, misse on seotud Log4j otseste ja kaudsete s\u00f5ltuvustega. Samas kasutatakse Log4j otsese esmaste s\u00f5ltuvusena vaid 17% juhtudest, samas kui 83% haavatavatest pakettidest on seotud Log4j kaudu vahepakettide, st teise ja k\u00f5rgema taseme s\u00f5ltuvuste kaudu (21% - teise taseme, 12% - kolmanda, 14% - neljanda, 26% - viienda, 6% - kuuenda). Haavatavuse parandamise tempod j\u00e4tavad hetkel soovida, n\u00e4dal p\u00e4rast haavatavuse avastamist on 35863 tuvastatud paketist probleem lahendatud vaid 4620-s, st 13%.

\"Veel<\/center> <\/p>\n

Samaan aikaan Yhdysvaltain kyberturvallisuus- ja infrastruktuurisuojausvirasto on julkaissut h\u00e4t\u00e4kannan, joka velvoittaa liittovaltion virastoja tunnistamaan Log4j:lle alttiit tietoj\u00e4rjestelm\u00e4t, ja p\u00e4ivitt\u00e4m\u00e4\u00e4n j\u00e4rjestelm\u00e4t bugin est\u00e4miseksi 23. joulukuuta menness\u00e4. Organisaatioiden on raportoitava suoritetuista toimenpiteist\u00e4 28. joulukuuta menness\u00e4. Ongelmallisten j\u00e4rjestelmien tunnistamista helpottamaan on laadittu lista tuotteista, joista on l\u00f6ytynyt haavoittuvuus (listalla on yli 23 000 sovellusta).
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Log4j 2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-45105), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0432 \u043e\u0442\u043b\u0438\u0447\u0438\u0435 \u043e\u0442 \u0434\u0432\u0443\u0445 \u043f\u0440\u043e\u0448\u043b\u044b\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c, \u043e\u0442\u043d\u0435\u0441\u0435\u043d\u0430 \u043a \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438 \u043e\u043f\u0430\u0441\u043d\u044b\u0445, \u043d\u043e \u043d\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445. \u041d\u043e\u0432\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0438 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0432\u0438\u0434\u0435 \u0437\u0430\u0446\u0438\u043a\u043b\u0438\u0432\u0430\u043d\u0438\u044f \u0438 \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u043e\u0433\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0441\u0442\u0440\u043e\u043a. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0447\u0430\u0441\u043e\u0432 \u043d\u0430\u0437\u0430\u0434 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Log4j 2.17. \u041e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0433\u043b\u0430\u0436\u0438\u0432\u0430\u0435\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":102662,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102661","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Toinen haavoittuvuus Log4j 2:ssa. Log4j-ongelmat vaikuttavat 8 %:iin Maven-paketeista | ProHoster","description":"Log4j 2 teeg on tuvastati veel \u00fcks haavatavus (CVE-2021-45105), mis erineb kahest eelmisest probleemist, kuna see kuulub ohtlike, kuid mitte kriitiliste probleemide hulka.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/eshhyo-odna-uyazvimost-v-log4j-2-problemy-v-log4j-zatragivayut-8-maven-paketov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0415\u0449\u0451 \u043e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Log4j 2. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 Log4j \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 8% Maven-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Log4j 2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-45105), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0432 \u043e\u0442\u043b\u0438\u0447\u0438\u0435 \u043e\u0442 \u0434\u0432\u0443\u0445 \u043f\u0440\u043e\u0448\u043b\u044b\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c, \u043e\u0442\u043d\u0435\u0441\u0435\u043d\u0430 \u043a \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438 \u043e\u043f\u0430\u0441\u043d\u044b\u0445, \u043d\u043e \u043d\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/eshhyo-odna-uyazvimost-v-log4j-2-problemy-v-log4j-zatragivayut-8-maven-paketov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-19T01:36:45+00:00","article:modified_time":"2021-12-19T01:36:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102661","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-19 01:36:58","updated":"2022-09-30 09:32:38","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102661","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=102661"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102661\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/102662"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=102661"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=102661"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=102661"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}