|
|
Content Assessment: Assessment and Advice - ENISA Update on Log4j Vulnerability
Information - 89%
Insight - 88%
Relevance - 92%
Objectivity - 91%
Authority - 95%
91%
Excellent
A short percentage-based assessment of the qualitative benefit of the recently published ENISA update the Log4j vulnerability.
Editor’s Note: On December 9th, information about a critical unauthenticated Remote Code Execution (RCE) vulnerability (CVE-2021-44228) that is affecting the well-known Java logging package Log4j used by many popular applications and web services was tweeted along with a proof-of-concept (PoC) posted on GitHub. This vulnerability could allow the attacker full control of the affected server if a user-controlled string is logged. Since it is easy to be exploited, the impact of this vulnerability is quite severe. This ENISA overview and updated CERT-EU security advisory may be beneficial for cybersecurity, information governance, and legal discovery professionals in the eDiscovery ecosystem facing the challenge of this vulnerability.
Media Announcement from ENISA and Report from CERT-EU*
Joint Statement on Log4Shell
The European Commission, the EU Agency for Cybersecurity, CERT-EU, and the network of the EU national computer security incident response teams (CSIRTs network) have been closely following the development of the Log4Shell vulnerability since 10 December 2021.
Log4Shell is a vulnerability in the well-known open-source Java logging package Log4j, which is maintained by the Apache Software Foundation. Log4j is used in a wide array of applications and web services across the globe. Due to the nature of the vulnerability, its ubiquity, and the complexity of patching in some of the impacted environments, it is important that all organizations, especially entities who fall under the Network and Information Security (NIS) Directive, assess their potential exposure as soon as possible.
The CSIRTs Network members are continuously updating a list of vulnerable software, which is maintained by the Dutch National Cyber Security Centre. It is important that adequate mitigation measures are applied in a timely manner and that organizations follow the guidance of their national cybersecurity authorities. The latest advisories published by the CSIRTs Network Members can be found in their relevant official communication channels. Organizations may also refer to guidance given by CERT-EU.
As this is a developing situation, we strongly recommend all organizations to regularly check the guidance provided by the CSIRTs Network Members and CERT-EU for the latest assessment and advice and to take actions as needed
The Agency and all relevant EU actors will continue to monitor this threat to contribute to the overall situational awareness at the Union level.
For technical background information about the vulnerability and recommendations: Security Advisory 2021-067 – CERT-EU
For guidance on response please refer to the relevant national authority: CSIRTs by Country – Interactive Map — ENISA
The latest advisories published by CSIRTs Network Members are available here: https://github.com/enisaeu/CNW/blob/main/advisories.md
CERT-EU-SA2021-067
See the original security alert.
*Shared with permission under Creative Commons – Attribution 4.0 International (CC BY 4.0) – license.
Additional Reading
- CISA Statement and Guidance: The “Log4j” Vulnerability
- Defining Cyber Discovery: A Definition and Framework
Source: ComplexDiscovery
