Log4j: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
6vffdh (Diskussion | Beiträge) |
6vffdh (Diskussion | Beiträge) |
||
| (10 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt) | |||
| Zeile 1: | Zeile 1: | ||
| − | : | + | :Info |
| + | |||
: Log4j-Zero-Day-Lücke bedroht Heimanwender und Firmen. | : Log4j-Zero-Day-Lücke bedroht Heimanwender und Firmen. | ||
: Die weitverbreitete Java-Programmbibliothek „log4j“ für die performante Aggregation von Protokolldaten weist kritische Lücken in den Versionen 2.0 bis 2.14.1 auf. | : Die weitverbreitete Java-Programmbibliothek „log4j“ für die performante Aggregation von Protokolldaten weist kritische Lücken in den Versionen 2.0 bis 2.14.1 auf. | ||
| + | |||
| + | :[https://jfrog.com/blog/log4shell-0-day-vulnerability-all-you-need-to-know/ log4shell-0-day-vulnerability-all-you-need-to-know] | ||
| + | |||
| + | : Almost all versions of log4j version 2 are affected. | ||
| + | :2.0-beta9 <= Apache log4j <= 2.14.1 | ||
| + | :Limited vulnerability in 2.15.0 | ||
| + | :As of Tuesday, Dec 14, version 2.15.0 was found to still have a possible vulnerability in some apps. We recommend updating to 2.16.0 which disables JNDI and completely removes %m{lookups}. | ||
| + | : Powershell | ||
Get-ChildItem -Recurse -Filter 'log4j-core*' | Get-ChildItem -Recurse -Filter 'log4j-core*' | ||
| − | :Verzeichnis: C:\ ... IoT-NanoESP\arduino-1.8.13-windows\arduino-1.8.13\lib\ 1402925 log4j-core-2.8.1.jar | + | : Verzeichnis: C:\ ... IoT-NanoESP\arduino-1.8.13-windows\arduino-1.8.13\lib\ 1402925 log4j-core-2.8.1.jar |
| − | :Verzeichnis: C:\AdminStick\ABF\z_USERTools\MediathekView-13.2.1\lib\1667269 log4j-core-2.12.0.jar | + | : Verzeichnis: C:\AdminStick\ABF\z_USERTools\MediathekView-13.2.1\lib\1667269 log4j-core-2.12.0.jar |
| + | : Verzeichnis: C:\Program Files (x86)\Arduino\lib\log4j-core-2.12.0.jar (-a---- 14.05.2021 16:24 1667269 ) | ||
| + | : Tlaunscher minecraft C:\Users\user\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-core\2.14.1 | ||
: APC / Schneider Electric - PowerChute Business Edition | : APC / Schneider Electric - PowerChute Business Edition | ||
| + | : Verzeichnis: C:\Users\admin....\Documents\Backup 20-04-2021\EasyAccess\Server\lib | ||
| + | |||
| + | |||
| + | |||
| + | |||
| + | =Tool= | ||
| + | |||
| + | :[https://github.com/adilsoybali/Log4j-RCE-Scanner Log4j-RCE-Scanner] | ||
| + | |||
| + | |||
| + | =VMware= | ||
| + | :[https://kb.vmware.com/s/article/87096 Workaround instructions to address CVE-2021-44228 & CVE-2021-45046 in vCenter Server Windows (87096)] | ||
| + | :[https://kb.vmware.com/s/article/87081 Workaround instructions to address CVE-2021-44228 and CVE-2021-45046 in vCenter Server and vCenter Cloud Gateway (87081)] | ||
Aktuelle Version vom 30. Dezember 2021, 15:53 Uhr
- Info
- Log4j-Zero-Day-Lücke bedroht Heimanwender und Firmen.
- Die weitverbreitete Java-Programmbibliothek „log4j“ für die performante Aggregation von Protokolldaten weist kritische Lücken in den Versionen 2.0 bis 2.14.1 auf.
- Almost all versions of log4j version 2 are affected.
- 2.0-beta9 <= Apache log4j <= 2.14.1
- Limited vulnerability in 2.15.0
- As of Tuesday, Dec 14, version 2.15.0 was found to still have a possible vulnerability in some apps. We recommend updating to 2.16.0 which disables JNDI and completely removes %m{lookups}.
- Powershell
Get-ChildItem -Recurse -Filter 'log4j-core*'
- Verzeichnis: C:\ ... IoT-NanoESP\arduino-1.8.13-windows\arduino-1.8.13\lib\ 1402925 log4j-core-2.8.1.jar
- Verzeichnis: C:\AdminStick\ABF\z_USERTools\MediathekView-13.2.1\lib\1667269 log4j-core-2.12.0.jar
- Verzeichnis: C:\Program Files (x86)\Arduino\lib\log4j-core-2.12.0.jar (-a---- 14.05.2021 16:24 1667269 )
- Tlaunscher minecraft C:\Users\user\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-core\2.14.1
- APC / Schneider Electric - PowerChute Business Edition
- Verzeichnis: C:\Users\admin....\Documents\Backup 20-04-2021\EasyAccess\Server\lib
Tool
