| A | B | C | D | E | F | |
|---|---|---|---|---|---|---|
1 | ABOUT LOG4J SECURITY ISSUES | Last update: 1/21/2022 | ||||
2 | ||||||
3 | What is Log4j? | |||||
4 | ||||||
5 | Almost every large application includes its own logging or tracing API to aid in development and auditing. Apache Log4j is a widely-adopted, open source logging package for Java deployed in hundreds of millions of systems worldwide, including in software used by K12 organizations. | |||||
6 | ||||||
7 | What is the urgent security concern with software using Log4j? | |||||
8 | ||||||
9 | On December 10, 2021 CVE-2021-44228 was published in the National Vulnerability Database. The Log4j vulnerability is TRIVIAL to exploit and rated '10.0 CRITICAL.' It allows threat actors to remotely take control of affected systems. CISA is urging all organizations to assess their exposure - directly and via their vendor relationships - and take steps to mitigate the vulnerability. | |||||
10 | ||||||
11 | Are there other security concerns with Log4j? | |||||
12 | Log4j Version | Vulnerabiities | Notes | |||
13 | The security concerns with use of Log4j vary depending on which versions are in use. (Note: software applications may run more than one instance and version of Log4j). | Log4j 1.X | Numerous | "Log4j 1.x has reached end of life and is no longer supported. Vulnerabilities reported after August 2015 against Log4j 1.x were not checked and will not be fixed. Users should upgrade to Log4j 2 to obtain security fixes." | ||
14 | Log4j 2 - 2.14.1 | CVE-2021-44228 | Severity: Critical | |||
15 | This is a developing situation and information is subject to change. | Log4j 2.15.0 | CVE-2021-45046 | Severity: Critical | ||
16 | Log4j 2.16.0 | CVE-2021-45105 | Severity: High | |||
17 | Log4j 2.17.0 | CVE-2021-44832 | Severity: Moderate | |||
18 | Log4j 2.17.1 | Most recent version. Released 12/28/2021 | ||||
19 | ||||||
20 | What should K12 organizations do to protect their users and IT systems from being exploited by a Log4j vulnerability? | |||||
21 | ||||||
22 | The most recent CVE has been addressed in Apache Log4j 2.17.1, released on December 28, 2021. The Apache Software Foundation recommends that users uprade to Log4j 2.3.2 (for Java 6), 2.12.4 (for Java 7), or 2.17.1 (for Java 8 and later). | |||||
23 | The developers have announced that these are the last updates that will be made available for Log4j that support Java 6 or 7. | |||||
24 | ||||||
25 | Where can I go for reliable information about Log4j? | |||||
26 | ||||||
27 | CISA "Apache Log4j Vulnerability Guidance" available online at https://www.cisa.gov/uscert/apache-log4j-vulnerability-guidance | |||||
28 | Joint Cybersecurity Advisory: "Alert (AA21-356A) Mitigating Log4Shell and Other Log4j-Related Vulnerabilities" available online at: https://www.cisa.gov/uscert/ncas/alerts/aa21-356a | |||||
29 | Apache Software Foundation: Apache Log4j 2 at https://logging.apache.org/log4j/2.x/index.html | |||||
30 | ||||||