{"id":80012,"date":"2021-12-15T13:56:22","date_gmt":"2021-12-15T13:56:22","guid":{"rendered":"https:\/\/www.passwordsafe.com\/?p=80012"},"modified":"2022-10-10T13:50:17","modified_gmt":"2022-10-10T13:50:17","slug":"log4j-0-day-mayhem","status":"publish","type":"post","link":"https:\/\/www.passwordsafe.com\/en\/blog\/log4j-0-day-mayhem\/","title":{"rendered":"LOG4j 0-day mayhem"},"content":{"rendered":"

15. December 2021 | Author: Jasleen Kaur | Category: Security<\/p>\n<\/div><\/div><\/div>

<\/span><\/div><\/div><\/div><\/div><\/div>

Password Secure unaffected by the exploit<\/h2><\/div>

On Thursday,\u00a0December 9th<\/a>, researchers discovered a 0-day exploit\u00a0(CVE-2021-44228)\u00a0in Apache Log4j (version 2), the open-source Java logging library. It allows attackers to gain unauthenticated access to log messages and remotely control the affected servers, making this impact highly severe. The exploit was initially discovered in Minecraft; however, researchers have warned that cloud applications are also highly vulnerable. Admins have been left scrambling ever since news of this security flaw came to light.<\/p>\n

Is Password Secure affected?<\/h3>\n

Password Secure<\/a> is aware of this exploit and concludes that our software is NOT AFFECTED by this vulnerability. No action is required for customers using our supported software versions 8.10 or higher.<\/p>\n

Another library used by Password Secure is the Log4js or Log4 Java Script.\u00a0It has no relation with Log4j or Log4 Java and is NOT affected by the vulnerability.<\/p>\n

Our security recommendations<\/h3>\n

For those using a version below 8.10, we urgently recommend updating to our latest version. We no longer provide support for version 8.9 and older, and being a critical component of system security, it is advisable to update your software.<\/p>\n

If you use the Apache server for Password Secure: the issue has already been fixed<\/a>, and therefore, we strongly recommend that you perform a server update.<\/p>\n

What is Apache Log4j?<\/h3>\n

As part of the Apache Logging project, Apache Log4j is popularly used by enterprises and developers worldwide, with the library being an easy way to log errors.<\/p>\n

\u201cMany large software companies and online services use the Log4j library, including Amazon, Apple iCloud, Cisco, Cloudflare, ElasticSearch, Red Hat, Steam, Tesla, Twitter, and many more. \u201c<\/strong><\/p>\n

Source.<\/a><\/p>\n

Why is CVE-2021-44228 just so dangerous?<\/h3>\n

Also called Log4Shell or LogJam,\u00a0CVE-2021-44228 is a Remote Code Execution\u00a0(RCE) class exploit. If attackers can gain remote access to any server, they can gain control of the company systems, install cryptominers, steal confidential data, and compromise networks.<\/p>\n

\u201cDevelopers use logging frameworks to keep track of what happens in a given application. To exploit Log4Shell, an attacker only needs to get the system to log a strategically crafted string of code. From there, they can load arbitrary code on the targeted\u201d.<\/strong><\/p>\n

Source.<\/a><\/p>\n

It can be as simple as setting this snippet as a harmless account username for hackers. Staying true to its nature, open-source software can be integrated wherever and whenever wanted and loiter around unprotected.<\/p>\n

Who are at risk?<\/h3>\n

An untold number of organisations are already exposed to potential remote code attacks and at risk of compromising sensitive information. Smaller, less agile organisations that lack the necessary resources and security infrastructure will be the first to take the fall. Others may see this crop up in future penetration tests. Millions of Java applications and open-source software use Log4j in different forms, which means enterprises using cloud platforms and web applications can also be at risk. The ubiquity of Log4j is yet to unfold.<\/p>\n

What now?<\/h3>\n

As of this minute, there already are alerts about malicious cryptominers and even botnets like Mirai, Tsunami, and Kinsing, leveraging the Log4j vulnerabilities to install crypto-mining malware. What\u2019s frightening is that Log4j will go on to wreak havoc for the unforeseeable future. While the full severity of this exploit is still coming into view, the best solution, for now, is to stock up with security measurements to shorten the tail of impact and make\u00a0necessary updates as latest as possible.<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/p>\n","protected":false},"excerpt":{"rendered":"

Password Safe is aware of this exploit and concludes that our software is NOT AFFECTED by this vulnerability. No action is required for customers using our supported software versions 8.10 or higher. Another library used by Password Safe is the Log4js or Log4 Java Script. It has no relation with Log4j or Log4 Java and is NOT affected by the vulnerability.<\/p>\n","protected":false},"author":9,"featured_media":80251,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[10],"tags":[731,730,732,733],"class_list":["post-80012","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-apache","tag-log4j","tag-log4shell","tag-logjam"],"acf":[],"yoast_head":"\nLOG4j 0-day mayhem – Password Secure<\/title>\n<meta name=\"description\" content=\"Read about the recent Apache Log4j vulnerability. Find out how it is impacting organisations and the measures to help mitigate its threats.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.passwordsafe.com\/en\/blog\/log4j-0-day-mayhem\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"LOG4j 0-day mayhem – Password Secure\" \/>\n<meta property=\"og:description\" content=\"Read about the recent Apache Log4j vulnerability. Find out how it is impacting organisations and the measures to help mitigate its threats.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.passwordsafe.com\/en\/blog\/log4j-0-day-mayhem\/\" \/>\n<meta property=\"og:site_name\" content=\"Password safe - Passwortverwaltung\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/passwordsafe\" \/>\n<meta property=\"article:published_time\" content=\"2021-12-15T13:56:22+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-10-10T13:50:17+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.passwordsafe.com\/wp-content\/uploads\/2021\/12\/Website-2021-Blog-Thumbnail.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"900\" \/>\n\t<meta property=\"og:image:height\" content=\"540\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Jasleen\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jasleen\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.passwordsafe.com\\\/en\\\/blog\\\/log4j-0-day-mayhem\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.passwordsafe.com\\\/en\\\/blog\\\/log4j-0-day-mayhem\\\/\"},\"author\":{\"name\":\"Jasleen\",\"@id\":\"https:\\\/\\\/www.passwordsafe.com\\\/en\\\/#\\\/schema\\\/person\\\/4bb96366f125621aec4285b3786fbb6c\"},\"headline\":\"LOG4j 0-day mayhem\",\"datePublished\":\"2021-12-15T13:56:22+00:00\",\"dateModified\":\"2022-10-10T13:50:17+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.passwordsafe.com\\\/en\\\/blog\\\/log4j-0-day-mayhem\\\/\"},\"wordCount\":2520,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.passwordsafe.com\\\/en\\\/blog\\\/log4j-0-day-mayhem\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.passwordsafe.com\\\/wp-content\\\/uploads\\\/2021\\\/12\\\/Website-2021-Blog-Thumbnail.jpg\",\"keywords\":[\"Apache\",\"Log4j\",\"Log4Shell\",\"LogJam\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.passwordsafe.com\\\/en\\\/blog\\\/log4j-0-day-mayhem\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.passwordsafe.com\\\/en\\\/blog\\\/log4j-0-day-mayhem\\\/\",\"url\":\"https:\\\/\\\/www.passwordsafe.com\\\/en\\\/blog\\\/log4j-0-day-mayhem\\\/\",\"name\":\"LOG4j 0-day mayhem – Password Secure\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.passwordsafe.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.passwordsafe.com\\\/en\\\/blog\\\/log4j-0-day-mayhem\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.passwordsafe.com\\\/en\\\/blog\\\/log4j-0-day-mayhem\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.passwordsafe.com\\\/wp-content\\\/uploads\\\/2021\\\/12\\\/Website-2021-Blog-Thumbnail.jpg\",\"datePublished\":\"2021-12-15T13:56:22+00:00\",\"dateModified\":\"2022-10-10T13:50:17+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.passwordsafe.com\\\/en\\\/#\\\/schema\\\/person\\\/4bb96366f125621aec4285b3786fbb6c\"},\"description\":\"Read about the recent Apache Log4j vulnerability. Find out how it is impacting organisations and the measures to help mitigate its threats.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.passwordsafe.com\\\/en\\\/blog\\\/log4j-0-day-mayhem\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.passwordsafe.com\\\/en\\\/blog\\\/log4j-0-day-mayhem\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.passwordsafe.com\\\/en\\\/blog\\\/log4j-0-day-mayhem\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.passwordsafe.com\\\/wp-content\\\/uploads\\\/2021\\\/12\\\/Website-2021-Blog-Thumbnail.jpg\",\"contentUrl\":\"https:\\\/\\\/www.passwordsafe.com\\\/wp-content\\\/uploads\\\/2021\\\/12\\\/Website-2021-Blog-Thumbnail.jpg\",\"width\":900,\"height\":540},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.passwordsafe.com\\\/en\\\/blog\\\/log4j-0-day-mayhem\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Startseite\",\"item\":\"https:\\\/\\\/www.passwordsafe.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"LOG4j 0-day mayhem\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.passwordsafe.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.passwordsafe.com\\\/en\\\/\",\"name\":\"Password safe - Passwortverwaltung\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.passwordsafe.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.passwordsafe.com\\\/en\\\/#\\\/schema\\\/person\\\/4bb96366f125621aec4285b3786fbb6c\",\"name\":\"Jasleen\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e9b1e8cedc2600e39a4f66ba7721bad52a93f70c4d63a162586d38bec99d8702?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e9b1e8cedc2600e39a4f66ba7721bad52a93f70c4d63a162586d38bec99d8702?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e9b1e8cedc2600e39a4f66ba7721bad52a93f70c4d63a162586d38bec99d8702?s=96&d=mm&r=g\",\"caption\":\"Jasleen\"},\"url\":\"https:\\\/\\\/www.passwordsafe.com\\\/en\\\/blog\\\/author\\\/jasleen\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"LOG4j 0-day mayhem – Password Secure","description":"Read about the recent Apache Log4j vulnerability. Find out how it is impacting organisations and the measures to help mitigate its threats.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.passwordsafe.com\/en\/blog\/log4j-0-day-mayhem\/","og_locale":"en_US","og_type":"article","og_title":"LOG4j 0-day mayhem – Password Secure","og_description":"Read about the recent Apache Log4j vulnerability. Find out how it is impacting organisations and the measures to help mitigate its threats.","og_url":"https:\/\/www.passwordsafe.com\/en\/blog\/log4j-0-day-mayhem\/","og_site_name":"Password safe - Passwortverwaltung","article_publisher":"https:\/\/www.facebook.com\/passwordsafe","article_published_time":"2021-12-15T13:56:22+00:00","article_modified_time":"2022-10-10T13:50:17+00:00","og_image":[{"width":900,"height":540,"url":"https:\/\/www.passwordsafe.com\/wp-content\/uploads\/2021\/12\/Website-2021-Blog-Thumbnail.jpg","type":"image\/jpeg"}],"author":"Jasleen","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Jasleen","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.passwordsafe.com\/en\/blog\/log4j-0-day-mayhem\/#article","isPartOf":{"@id":"https:\/\/www.passwordsafe.com\/en\/blog\/log4j-0-day-mayhem\/"},"author":{"name":"Jasleen","@id":"https:\/\/www.passwordsafe.com\/en\/#\/schema\/person\/4bb96366f125621aec4285b3786fbb6c"},"headline":"LOG4j 0-day mayhem","datePublished":"2021-12-15T13:56:22+00:00","dateModified":"2022-10-10T13:50:17+00:00","mainEntityOfPage":{"@id":"https:\/\/www.passwordsafe.com\/en\/blog\/log4j-0-day-mayhem\/"},"wordCount":2520,"commentCount":0,"image":{"@id":"https:\/\/www.passwordsafe.com\/en\/blog\/log4j-0-day-mayhem\/#primaryimage"},"thumbnailUrl":"https:\/\/www.passwordsafe.com\/wp-content\/uploads\/2021\/12\/Website-2021-Blog-Thumbnail.jpg","keywords":["Apache","Log4j","Log4Shell","LogJam"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.passwordsafe.com\/en\/blog\/log4j-0-day-mayhem\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.passwordsafe.com\/en\/blog\/log4j-0-day-mayhem\/","url":"https:\/\/www.passwordsafe.com\/en\/blog\/log4j-0-day-mayhem\/","name":"LOG4j 0-day mayhem – Password Secure","isPartOf":{"@id":"https:\/\/www.passwordsafe.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.passwordsafe.com\/en\/blog\/log4j-0-day-mayhem\/#primaryimage"},"image":{"@id":"https:\/\/www.passwordsafe.com\/en\/blog\/log4j-0-day-mayhem\/#primaryimage"},"thumbnailUrl":"https:\/\/www.passwordsafe.com\/wp-content\/uploads\/2021\/12\/Website-2021-Blog-Thumbnail.jpg","datePublished":"2021-12-15T13:56:22+00:00","dateModified":"2022-10-10T13:50:17+00:00","author":{"@id":"https:\/\/www.passwordsafe.com\/en\/#\/schema\/person\/4bb96366f125621aec4285b3786fbb6c"},"description":"Read about the recent Apache Log4j vulnerability. Find out how it is impacting organisations and the measures to help mitigate its threats.","breadcrumb":{"@id":"https:\/\/www.passwordsafe.com\/en\/blog\/log4j-0-day-mayhem\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.passwordsafe.com\/en\/blog\/log4j-0-day-mayhem\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.passwordsafe.com\/en\/blog\/log4j-0-day-mayhem\/#primaryimage","url":"https:\/\/www.passwordsafe.com\/wp-content\/uploads\/2021\/12\/Website-2021-Blog-Thumbnail.jpg","contentUrl":"https:\/\/www.passwordsafe.com\/wp-content\/uploads\/2021\/12\/Website-2021-Blog-Thumbnail.jpg","width":900,"height":540},{"@type":"BreadcrumbList","@id":"https:\/\/www.passwordsafe.com\/en\/blog\/log4j-0-day-mayhem\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Startseite","item":"https:\/\/www.passwordsafe.com\/en\/"},{"@type":"ListItem","position":2,"name":"LOG4j 0-day mayhem"}]},{"@type":"WebSite","@id":"https:\/\/www.passwordsafe.com\/en\/#website","url":"https:\/\/www.passwordsafe.com\/en\/","name":"Password safe - Passwortverwaltung","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.passwordsafe.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.passwordsafe.com\/en\/#\/schema\/person\/4bb96366f125621aec4285b3786fbb6c","name":"Jasleen","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/e9b1e8cedc2600e39a4f66ba7721bad52a93f70c4d63a162586d38bec99d8702?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/e9b1e8cedc2600e39a4f66ba7721bad52a93f70c4d63a162586d38bec99d8702?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e9b1e8cedc2600e39a4f66ba7721bad52a93f70c4d63a162586d38bec99d8702?s=96&d=mm&r=g","caption":"Jasleen"},"url":"https:\/\/www.passwordsafe.com\/en\/blog\/author\/jasleen\/"}]}},"_links":{"self":[{"href":"https:\/\/www.passwordsafe.com\/en\/wp-json\/wp\/v2\/posts\/80012","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.passwordsafe.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.passwordsafe.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.passwordsafe.com\/en\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/www.passwordsafe.com\/en\/wp-json\/wp\/v2\/comments?post=80012"}],"version-history":[{"count":0,"href":"https:\/\/www.passwordsafe.com\/en\/wp-json\/wp\/v2\/posts\/80012\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.passwordsafe.com\/en\/wp-json\/wp\/v2\/media\/80251"}],"wp:attachment":[{"href":"https:\/\/www.passwordsafe.com\/en\/wp-json\/wp\/v2\/media?parent=80012"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.passwordsafe.com\/en\/wp-json\/wp\/v2\/categories?post=80012"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.passwordsafe.com\/en\/wp-json\/wp\/v2\/tags?post=80012"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}