{"id":112211,"date":"2023-12-14T15:10:18","date_gmt":"2023-12-14T13:10:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/tret-java-proektov-na-baze-biblioteki-log4j-prodolzhayut-ispolzovat-uyazvimye-versii"},"modified":"2023-12-14T15:10:18","modified_gmt":"2023-12-14T13:10:18","slug":"tret-java-proektov-na-baze-biblioteki-log4j-prodolzhayut-ispolzovat-uyazvimye-versii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/tret-java-proektov-na-baze-biblioteki-log4j-prodolzhayut-ispolzovat-uyazvimye-versii","title":{"rendered":"Nj\u00eb e treta e projekteve Java q\u00eb p\u00ebrdorin bibliotek\u00ebn Log4j vazhdojn\u00eb t\u00eb p\u00ebrdorin versione t\u00eb cenueshme.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Kompania Veracode publikoi rezultatet e nj\u00eb studimi mbi r\u00ebnd\u00ebsin\u00eb e dob\u00ebsive kritike n\u00eb bibliotek\u00ebn Java Log4j, t\u00eb identifikuara vitet e kaluara. Pas shqyrtimit t\u00eb 38278 aplikacioneve q\u00eb p\u00ebrdoren n\u00eb 3866 organizata, studiuesit e Veracode zbuluan se 38% e tyre p\u00ebrdorin versione t\u00eb prekura t\u00eb Log4j. Shkaku kryesor i vazhdimit t\u00eb p\u00ebrdorimit t\u00eb kodit t\u00eb vjet\u00ebr \u00ebsht\u00eb inkorporimi i bibliotekave t\u00eb vjetra n\u00eb projekte apo v\u00ebshtir\u00ebsia e migrimit nga deg\u00ebt e mb\u00ebshtetjes n\u00eb deg\u00eb t\u00eb reja, t\u00eb cilat shkelin p\u00ebrputhshm\u00ebrin\u00eb mbrapa (sipas raportit t\u00eb kaluar t\u00eb Veracode, 79% e projekteve t\u00eb kodit t\u00eb transferuara nga bibliotekat e pal\u00ebve t\u00eb treta kurr\u00eb nuk p\u00ebrdit\u00ebsohen pas k\u00ebsaj). <\/p>\n
Jan\u00eb identifikuar tri kategori kryesore aplikacionesh q\u00eb p\u00ebrdorin versione t\u00eb prekura t\u00eb Log4j: <\/p>\n
\n
2.8% e aplikacioneve vazhdojn\u00eb t\u00eb p\u00ebrdorin versione Log4j nga 2.0-beta9 deri n\u00eb 2.15.0, q\u00eb p\u00ebrmbajn\u00eb dob\u00ebsin\u00eb Log4Shell (CVE-2021-44228).\n
3.8% e aplikacioneve p\u00ebrdorin versionin Log4j2 2.17.0, ku dob\u00ebsia Log4Shell \u00ebsht\u00eb eliminuar, por mbetet e pa rregulluar dob\u00ebsia CVE-2021-44832, e cila lejon ekzekutimin e kodit n\u00eb distanc\u00eb (RCE).\n
32% e aplikacioneve p\u00ebrdorin deg\u00ebn Log4j2 1.2.x, mb\u00ebshtetje p\u00ebr t\u00eb cil\u00ebn ka p\u00ebrfunduar q\u00eb n\u00eb vitin 2015. Kjo deg\u00eb \u00ebsht\u00eb e ekspozuar ndaj dob\u00ebsive kritike CVE-2022-23307, CVE-2022-23305 dhe CVE-2022-23302, t\u00eb identifikuara n\u00eb vitin 2022, pas 7 vjet\u00ebsh q\u00ebndrrimi pa mb\u00ebshtetje. <\/ul>\n