What You Need to Know about Log4Shell (CVE-2021-44228)
On December 9, 2021 a flaw was publicly disclosed in Apache’s Log4j 2, a logging utility used by Java applications. Named Log4Shell (CVE-2021-44228), the vulnerability can be used by attackers to take control of affected servers. According to reports, it is actively being targeted in the wild.
To exploit Log4Shell, an attacker needs to get the system to log a strategically crafted string of code. From there arbitrary code can be loaded on the targeted server to install malware or launch other attacks.
Apache has already patched the Log4Shell exploit.
How we responded
As soon as the vulnerability was disclosed, 1Kosmos assessed our service infrastructure to determine any exposure. We tested and validated the patch for any impact it might have on customer deployments and availability, before we implemented any remediation steps. On December 16, we pushed the remediation to all affected servers.
Is my environment vulnerable?
No, the 1Kosmos platform is no longer vulnerable to CVE-2021-44228. Based on current available data, there is no indication that the exploit has been successfully used against 1Kosmos services.
Recommendations
No action is needed at this time. All remediations have been implemented by 1Kosmos.
Questions
If you need any further information about the Log4Shell vulnerability sign in to the support portal, or contact us: (201) 299-5631.
The 1Kosmos Team
