Vulnerabilityhigh

Google: More than 35,000 Java packages impacted by Log4j vulnerabilities

The RecordJan 18, 2023 · 00:00 UTC (Jan 18, 2023)2 min read4

Read at therecord.media

Analyze CVE-2021-44228 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2021-44228 CVE-2021-45046

Tags: cve-2021-44228 cve-2021-45046 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2021-44228	JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell)	10.0	100%	KEVRansomwarePoC ×9	Dec 10, 2021 KEV Dec 10, 2021
CVE-2021-45046	Remote Code Execution in Apache Log4j2 via Incomplete Log4Shell Fix	9.0	100%	KEVRansomwarePoC	Dec 14, 2021 KEV May 1, 2023

From the original article

2 min read at therecord.media

Google's open-source team said they scanned Maven Central, today's largest Java package repository, and found that 35,863 Java packages use vulnerable versions of the Apache Log4j library. This includes Java packages that use Log4j versions vulnerable to the original Log4Shell exploit ( CVE-2021-44228 ) and a second remote code execution bug discovered in the Log4Shell patch ( CVE-2021-45046 ).

The Record

therecord.media

Read the full article at The Record

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.